U,S. Department of Justice 



Federal Bureau of Investigation 

Washington. D.C. 20535 


foundation 

S^lmNC^Ca 1 0 September 24, 2007 

Subject: SYSTEM DCS-3000 and RED HOOK 
FOlPA No. 1056287- 000 and FOlPA No. 1056307-1 


Dear Ms. Hofmann : 

The enclosed documents were reviewed under the Freedom of Information/Privacy Acts (FOlPA), Title 5, 
United States Code, Section 552/552a. Deletions have been made to protect information which is exempt from disclosure, 
with the appropriate exemptions noted on the page next to the excision. In addition, a deleted page Information sheet was 
inserted in the file to Indicate where pages were withheld entirely. The exemptions used to withhold Information are marked 


below and explained on the enclosed Form OPCA-16a: 

Section 552 Section 552a 

^(b)(1) □(b)(7)(A) n(d)(5) 

^(b)(2) □(b)(7)(B) □0)(2) 

□(b)(3) ®(b)(7)(C) □(k)(1) 

□(b)(7)(D) n(k)(2) 

«(b)(7)(E) n(k)(3) 

□(b)(7)(F) D(k)(4) 

□(b)(4) □(b)(8) G(k)(5) 

□(b)(5) □(b)(9) n(k)(6) 

K(b)(6) n(k)(7) 


502 page(s) were reviewed and 342 page(s) are being released. 

□ Document(s) were located which originated with, or contained information concerning other 
Government agency(ies) [OGA]. This information has been: 

□ referred to the OGA for review and direct response to you. 

□ referred to the OGA for consultation. The FBI will correspond with you regarding this 
information when the consultation is finished. 

□ You have the right to appeal any denials in this release. Appeals should be directed in 
writing to the Director, Office of Information and Privacy, U.S. Department of Justice,1425 
New York Ave., NW, Suite 11050, Washington, D.C. 20530-0001 within sixty days from the 
date of this letter. The envelope and the letter should be clearly marked “Freedom of Information 
Appeal” or “Information Appeal.” Please cite the FOlPA number assigned to your request so that it 
may be easily identified. 



□ The enclosed material is from the main investigative file(s) in which the subject(s) of your request was 
the focus of the investigation. Our search located additional references, in files relating to other 
individuals, or matters, which may or may not be about your subject(s). Our experience has shown, 
when ident, references usually contain information similar to the information processed in the main file(s). 
Because of our significant backing, we have given priority to processing oniy the main investigative fiie(s). 
if you want the references, you must submit a separate request for them in writing, and they wili be 
reviewed at a iater date, as time and resources permit. 

K See additional information which follows. 


Sincerely yours. 


David M. Hardy 
Section Chief 
Record/I nformation 
Dissemination Section 
Records Management Division 


Enclosure(s) 


Piease be advised that this is the fifth interim release as ordered by the court on May 7, 2007 for 
documents concerning surveiiiance systems known as DCS-3000 and Red Hook. 

The first page of this correspondence reflects that 502 pages were reviewed for this reiease. There were 
actualiy 963 pages reviewed, however, after a review by the technical operations group that manages the system, they 
determined that 461 pages of this materiai was not responsive to the request. 

A decision as not been made concerning your request for a waiver of fees. We wili be corresponding with 
you concerning that request in the near future. In the interim, we are providing you with the enclosed documents. 
Pursuant to Title 28, Code of Federal Regulations, Section 16.11, there is fee to ten cents per page for duplication. No 
fees are assessed for the first 1 00 pages. If it is determined that you do not qualify for a fee waiver, duplication fees will 
be assessed accordingly. 



EXPLANATION OF EXEMPTIONS 


SUBSECTIONS OF TITLE 5, UNITED STATES CODE, SECTION 552 

(b)(1) (A) specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign 

policy and (B) are in fact properly classified to such Executive order; 

(b)(2) related solely to the internal personnel rules and practices of an agency; 

(b)(3) specifically exempted from disclosure by statute (other than section 552b of this title), provided that such statute(A) requires that the 
matters be withheld from the public in such a manner as to leave no discretion on issue, or (B) establishes particular criteria for 
withholding or refers to particular types of matters to be withheld; 

(b)(4) trade secrets and commercial or financial information obtained from a person and privileged or confidential; 

(b)(5) inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation 
with the agency; 

(b)(6) personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy; 

(b)(7) records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement 

records or information ( A ) could be reasonably be expected to interfere with enforcement proceedings, ( B ) would deprive a person 
of a right to a fair trial or an impartial adjudication, ( C ) could be reasonably expected to constitute an unwarranted invasion of personal 
privacy, ( D ) could reasonably be expected to disclose the identity of confidential source, including a State, local, or foreign agency or 
authority or any private institution which furnish^ information on a confidential basis, and, in the case of record or information compiled 
by a criminal law enforcement authority in the course of a criminal investigation, or by an agency conducting a lawful national security 
intelligence investigation, information furnished by a confidential source, ( E ) would disclose techniques and procedures for law 
enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such 
disclosure could reasonably be expected to risk circumvention of the law, or ( F ) could reasonably be expected to endanger the life or 
physical safety of any individual; 

(b)(8) contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for 
the regulation or supervision of financial institutions; or 

(b)(9) geological and geophysical information and data, including maps, concerning wells. 

SUBSECTIONS OF TITLE 5, UNITED STATES CODE, SECTION 552a 

(d)(5) information compiled in reasonable anticipation of a civil action proceeding; 

(j) (2) material reporting investigative efforts pertaining to the enforcement of criminal law including efforts to prevent, control, or reduce 

crime or apprehend criminals; 

(k) ( 1 ) information which is currently and properly classified pursuant to an Executive order in the interest of the national defense or foreign 

policy, for example, information involving intelligence sources or methods; 

(k)(2) investigatory material compiled for law enforcement purposes, other than criminal, which did not result in loss of a right, benefit or 

privilege under Federal programs, or which would identify a source who furnished information pursuant to a promise that his/her identity 
would be held in confidence; 

00 ( 3 ) material maintained in connection with providing protective services to the President of the United States or any other individual pursuant 
to the authority of Title 18, United States Code, Section 3056; 

(k)(4) required by statute to be maintained and used solely as statistical records; 

(k)(5) investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian 
employment or for access to classified information, the disclosure of which would reveal the identity of the person who furnished 
information pursuant to a promise that his/her identity would be held in confidence; 

(k)(6) testing or examination material used to determine individual qualifications for appointment or promotion in Federal Government service the 
release of which would compromise the testing or examination process; 

(k)(7) material used to determine potential for promotion in the armed services, the disclosure of which would reveal the identity of the person 
who furnished the material pursuant to a promise that his/her identity would be held in confidence. 
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Federal Bureau of Investigation 



Message 


Page 1 of 3 



o 


Below I have combined the errata from your previous 3 e-mails. If there is anything more that I have missed 
please let us know. I count 26 line items. As I said in my earlier mail I will be working these issues tomorrow. If 
you would like, please stop by and we can discuss these. 


1 . Cover page Classification is either "derived from" or "classified by", not both. 

2. Page 8, Introduction. Remove the parenthetical from the last sentence. This appendix will include the system 
location, security contacts, equipment list, software that is not in the SSP baseline and a description of the 
physical security controls to Include facility accreditation information. 

3. The system description in various places is not clear about what I s DCS-5000 as the name is used to describe 

the core functionality and also the inclusion ot l i Paoe 10, Section 1 .2 is the first place this is 

mentioned. I suggest that the original scope of DCS-5000 be referred to as the core or other term to distinguish it 
from the entire system. At least in Section 1.2 and advisable elsewhere reference Appendixes J and K. 

4. Page 1 1 Section 1 .2.3 shows spreadsheets are used, but there is no spreadsheet software listed in the 
software list an otherwise shown in Section 5 of Appendix J spreadsheets are not mentioned. 

5. Page 12, again, there needs to be mention of documentation for each site. Section 2.1 should mention the 
appendix containing this information and Section 2.2 would include a requirement to document any site specific 
hardware that is not baseline hardware. 

6. Page 13 talks about SCI material yet page 12 shows the facility is cleared for Secret. Is the space actually 
processing and/or storing Secret SCI data? If so, what compartment(s)? Closed storage would also include TS. 
SCI is not a classification. | p s a whole is not a SCIFs. 

7. Page 1 3, remove the first sentence in Section 2.4. 

8. P ^e 15 Section 3.5 notes that the raw data is classified Secret, but it is not considered to be classified when it 

is on I b ropertv. Add a note to describe when the data becomes classified. This may be when the data is 

actually as^ciated with a case or other information. 


1. In past drawings foi l ■ IlSthisstiU the 

case? ifsn than wa need to either update the network aiaarams or rerere nceTSl | 

diagrams and provide the appropriate text to at ieast Section 3.9.6 and fti d I 


4/13/2007 


ALL BTFORmTIOHr COHTAIMED 

HEPZIff IS IHJCLASSIFIED 

DATE 06-05-2007 BY 65179ii(ih/ksE/mai 


b2 

b7E 


b2 

b7E 



Message 


Page 2 of 3 


0 In SRtj ttnn 7.3.1 1 OH the top Of page 28, there is a reference to agencies. It almost looks like ’agency” is a 
I I term and in our case would be Field Offices, Resident Agencies and/or users. If this is not the case, and 

the agencies are outside of FBI, we have a major bump in the road. 


be 

b7C 


9. Page 16, Section 3.9.1 add: 
Phone lines unclassified N/A 
DCS-3000 SBU FBI 




^ kks abouf 


1 In various drawings I have seen i | ls used to connec t i 


s still the case? If so, this will also need to be added here and the appropriate ripple effects. 


10. Page 17, Section 3.9.2. After ! [ add ", 
inspection of the special attention is needed for th< 


their alternates". Add a note stating that the 
lines to the TIU. 


1 1 . Page 1 7, Section 3.9.3jJbajmening statement is incorrect. DCS-3000 and th ^ { connections are 

interconnections. Replace } | wth"FBI". ^ 

12. Page 17. Section 3.9.5. Include the } { lines. 


13. Page 17. Section 3.9.6. Remove the last sentence in the second paragraph. liT 
^document what data crosses that connection. *“ 


14. Page 19, Section 3.9.9. Remove DCS-3000 as an indirect connection. 


15. Page 20, Section 5.3 part b. What d oes "Agen cy refer to"? This question also applies to page 28 Section 
7.3. 1 1 . It almost looks like "agency" is a { { term and in our case would be Field Offices, Resident Agencies 
and/or users. In part c add "TCP”. 


16. Page 22, Section 7.1 . Replace entire section with a reference to the Risk Management Matrix. 

17. Page 23, Set ^on 7.2.1 . vs mich systems on the system diagram on page 42 in Attachment D is the domain 

controller and th ^ { ? 

18. Page 23, Section 7.2.1 . Note that eac j f ias their own account wit j b rlvileges. 


b2 

b7E 


19. Page 23, Section 7.2.1. In the last paragraph In this section needs to state the FBINET workstations and 
domain controllers are not connected to DCS-5000. Does DCS-5000 use FBINET user names? You could also 
add a note that at each users workspace is a DCS-5000 workstation and a FBINET workstation. 


20. Pages 23, 25. 2 7 28. 30 and 31. Se ctions 7.2.1, 7.2.2, 7.2.6-9, 7.3.5, 7.3.7, 7.4.1, 7.6.1 and 7.6.3. Include 
details as needed fo{^^^_^^^_]equipment. 

21 . Page 27, Section 7.3,9. In the last sentence change "that" to "who". 

22. Page 27, Section 7.3.10. Replace the contents of this section with "N/A". 

23. Page 27, Section 7.3.1 1 . What does "prior clearance allows” mean? 


4/13/2007 
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SENS ITIVE BU T UNC L ASSIF IED 
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Message 


Page 1 of 1 


c 


I 


](RMD) (FBI) 

15 


!ecD) (CON) 


Sant: Monday, September 12, 2005 4:25 PM 

' (CQNJZZ 

JOTO) (CON) I 


(SecD) 

Subject: DCS-5000 & Telephone circuits 


be 

b7C 




■JOTD^-“ 

[C0N):| 


SENS ITIVE BUT U NCLASSIFIED 
NON-RECORD 


Both analog and digital telephone circuits can be two way. The implementation and use of circuits for CALEA 
purposes has call content data only going one way. This does not mean that there cannot be two way 
communications. 


On analog circuits it is trivial to install splitters at both ends of a copper wire pair and attach DSL modems in order 
to have full duplex communications. Digital circuits are two way. In addition to the audio data being pushed by 
the telco, there is signaling information that goes both ways. I doubt that the TIU without additional equipment on 
both ends to the connection Is capable of using the connection to leak dassifi^ information. 

In any event, I found information that strongly argues for the analog connection. The digital connection has a 
dedicated channel to include the Call Data. Since DCS-5000 gets this data from the DCS-3000 it looks like DCS- 
5000 is purposely designed to accept only analog data. 


So, the upside to this is that the check to ensure that the telephone circuit is to verify that no splitters or taps are 
connected to the phone lines from the time they enter dassified spaces and the sound cards in the TIU. For the 
truly paranoid, low pass filters can be installed on the phone lines as close as possible to the entry point of the 
dassified space. 


IZZl 


be 

b7C 


SENSI TIVE B UT UNCLASSIFIED 


ALL HTFORMATICW COJITAIHEI) 

HEREIir IS OTCLAS3IFIED 

DATE 06-05-2007 BY 65179 ctali/ksr/maj 
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From: 

Sent; 

To: 

Cc: 

Subject: 


Hi, 

I have been bothered for some time by the issue of the classification of the data coming from the phone yMnnanv. 

Searching the Internet and Trilogy has not provided any clear relevant details. I have discussed this with ! I 

without any resolution. The court orders that are sent to the phone company are usually classified Secret and the 
exceptions are almost always Top Secret. The blank form that agents fill out to request court orders is classified Secret. 

The phone companies are required to have cleared people available to process these court orders. I feel that a 
classificatign authority may consider the results of the CQUft Qrtier„be.Cla5§ifi,Ml,tg, tfr? 
that th ^ | being filtered through 

My question is do we want to chase this down? If so, who do we contact? 

hlE 

he 

hlC 




ALL lETFOPilATIOir COirTABIED 

HEPEIU IS OTCLA33IFIED 

DATE 06-05-2007 BY 65179iamh/ksr/maj 




Message 


Page 1 of 2 


kRMD) (FBI) 


JsecD) (CON) 


From: 

Sent; Wednesday, September 14, 2005 4:42 PM 

To: 

Cc: 


~n:OTD) /C QN1 
Jtd) (FBI){_ 


' (5ecD)(C 0N) 

Subject: DCS-500C | | x>mment3 Part 2 


be 

_Jb7C . 


](OTD) (CON)f 


h2 

hlE 


More of the same ;-) 

9. Page 16, Section 3.9.1 add: 
Phone lines unciassified N/A 
DCS-3000 SBU FBI 


fo2 

b7E 


1 


isks about 


various drawings I have seen] 


is used to conni 


JT-\ 


pthis still the case? If so, this will also need to be added here and the appropriate ripple eitects. 


10. Page 1 7, Section 3.9.2. After "ISSO" add ”, siteJSSDs or their alternates”. Add a note stating that the 
Inspection of the special attention is needed for foe | l ines to the TIU. 


lening statement is incorrect. DCS-3000 and the telco connections are 
vith "FBI". 

b2 

12. Page 17, Section 3.9,5. Include the telco lines. 


11. Page 17, Section 3.9.3. 
interconnections. Replace 


13. Page 17 , 


j. Section 3.9.6. Remove the last sentence in the second paragraph, 
document what data crosses that connection. 


s connected to 


14. Page 1 9, Section 3.9.9. Remove DCS-3000 as an indirect connection. j 

15. Page 20, Section 5.3 part b. What d oes "Agen cy refer to”? This question also applies to page 28 Section 

7.3. 1 1 . It almost looks like "agency” is a | | term and in our case would be Field Offices, Resident Agencies 

and/or users. In part c add "TCP". 

16. Page 22, Section 7.1 . Replace entire section with a reforence to the Risk Management Matrix. 

17. Page 23, Se ction 7.2.1. Wh ich systems on the system diagram on page 42 in Attachment D is the domain 

controller and th ^ P 

18. Page 23, Section 7.2.1 . Note that each ISSO has their own account with iSSO privileges. 

19. Page 23, Section 7.2.1. In the last paragraph in this section needs to state the FBINET workstations and 
domain controllers are not connected to DCS-5000. Does DCS-5000 use FBINET user names? You could also 
add a note that at each users workspace is a DCS-5000 workstation and a FBINET workstation. 

20. Pages 23, 25, 27 28. 30 and 31. Se ctions 7.2.1, 7.2.2, 7.2.6-9, 7.3.5, 7.3.7, 7.4.1 , 7.6.1 and 7.6.3. Include 

details as needed fot j [ equipment. 


b2 

b7E 


4/13/2007 


ALL IHTOPmTIOM COHTABIED 

HEREIH IS OTCLA3SIFIED 

DATE 06-05-2007 BY 65179DHH/K3R/HAJ 



Page 2 of 2 


21 . Page 27, Section 7.3.9. In the last sentence change "that” to "who". 

22. Page 27, Section 7.3.10. Replace the contents of this section with "N/A". 

23. Page 27, Section 7.3.1 1 . What does "prior clearance allows” mean? 

Sorry I did not get further with this today as I am also have two other systems that are active right now. I am 
expecting to be at Quantico tomorrow and hopefully we can get together and hammer this thing into submission. 

be 

b7C 



SENSITIVE BUT UNCLASSIFIED 
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Page 1 of 1 


^RMD) (FBI) 


]0TD) (CON) 
Sent: Monday, June 20, 2005 4 :23 PM 

To: I l (SecD) (CON) 

Subject: DCS-5000 Tier Designation 


SBCRST//N OFORN 
RECORD 6 6F-HQ-1410162 


bo 

b7C 


be 

b7C 


b2 

b7E 


As promised, please find attached the Accreditation b 
jOissiaut^ments for the respective systems such a 


undarv drawing for the DCS; 
I DCS-3000l 


lOOtoinciudetheLoC’sand 



be 

b7C 


9BCB ET//NOFORN 



ALL IHFOPmTIOH COHTAIHED 

HERE III IS UIJCLAS3I FIED 

DATE 06-05-2007 BY 65179/DHH/KSR/HAJ 
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^LUIVL I 


Yii'i iiiiiiii'i'famiTTTTi 


Mission Statements; 


DCS-5000 is intended to monitor, exploit, and disseminate intelligence from 
Foreign Intelligence Surveillance Act (FISA) electronic surveillance in a collaborative 
environment among linguists, case agents, and case managers. The system will provide 
these services in Field divisions and FBIHQ. 


Work Flow Manager (WFM) 

jjS^The Workflow Manager is subsystem of the DCS-5000, It is intended to provide 
centralized workflow management for field offices and FBIHQ. In field offices where 
there is a cj^ability shortage for certain languages, Workflow Manager provides 
management for the distribution of translations, statistics on translation backlogs, 
translation completed and inter-office work transfers. 


(S) 



b2 

IbVE 


(U) The DCS3000 application suite was developed to assist law enforcement agencies 
(LEA) with collecting and processing data for court-ordered ELSUR operations. The 
DCS3000 was developed as an interim solution, which is intended for use until 
commercial collection platforms are available. It is a dedicated system with no 
connectivity to other networks and for which all users (i.e., FBI, DEA, and LEA 
personnel) have clearances equal to or higher than the data passing through system. In 
addition, all users are authorized access and have the need-to-know for all data passing 
through the system. 

To conduct court-ordered ELSUR operations, LEA personnel dial into switches, which 
are devices used by telecommunications sCTvice providers to route telq>hone calls to their 
destinations. The DCS3000 can collect ELSUR data under the following warrant types: 
Pen Register; Deals with call data 
Title ni: Deals with call data and content 


(U) 


b2 

b7E 




Jwill provide a uniform approach to all ELSUR data management and analysis 

“activities supporting all field offices. Such an approach is necessary because no single 
system tha t is curren tly deployed interfaces to multiple collection systems and databases. 
In addition i t yill provide a common interface to these multiple collection systems 
and will enable a user to a ccess the data generated/processed by any collection sj^tem 
located in any field office. | | will also be the source of ELSUR information to 


DATE: Oe-OS-2007 
CLASSIFIED BY 65179dmli/ksi:/maJ 
REASOH: 1.4 (G) 

DECLASSIFf OH: 06-05-2032 


■SECnET/i'HOPOnN 


pg-1 


ALL IirrORHATIOlJ COHTAIHED 
HEFEIir IS UNCLASSIFIED EXCEPT 
tOHEEE SHOOT OTHERWISE 


s&eftFT 




enterprise-level case management and intelligence aggregation systems (e.g.. Virtual 
Case File). 

Th d I mission is to monitor the operational availability of the national security 

electronic surveillance (ELSUR) systems d^loyed to the field. These systems are used 
to collect court-ordered intercepts of telephony information. These systems also provide 
'^2 the capability to analj^e the information and/or provide it to the appropriate location for 

^ ^ further analysis and dissemi nation. 

The specific objectives of th d | are to provide the following capabilities on a 24x7 

basis: 

1 . Help desk support to all field offices with collection systems 

2. Monitoring and reporting on the health of Central Monitoring Plants (CMPs) to 
include the status of temperature, power, humidity, and pressure 

3. Momtoiinjg and reporting on the health and performance of collection systems 
instdled within the CMPs 

4. Remote troubleshooting and resolution of identified system problems 

5 . Prompt generation and maintenance of Recommended Operating Procedures 

6. Maintenance of a knowledge-based database containing failure and recovery 
information 

7. Facilitation of a preventive maintenance program 

8. Facilitation of contingency operations for the field and TICTU 

9. Facilitation of increased communications between the field and Engineering 
Research Facility (ERF) Technology Managers regarding system problems and 
deficiencies and their associated resolution 


pg-2 


- SECnET//MUliUKN~ 










[ 


From: 

Sent: 

To: 

Cc: 


|(RMD) (FBI) 

I k SecD) (CON) 

Monday, June 20, 2 005 4:25 PM 

I ~|( SecD)(CON) 

1 t secD) (CON)I 


Subject: FW: DCS-5000 Tier Designation 


bb 

Jb7C 


](SecD) (CON) 


• 5 E C.H LH/ NOFORN 
RgGQRD 66F-JH£t141QJJK 


Hi. 


Hot off the press, i have not looked at it. 

nu 

IZZI 


Original Message 


H(0TD)(C0N) 


Se nt; Monday, June 20, 20 05 4:23 PM 
Toi l l fSecD> (CON) 

Subject: DCS-5000 Tier Designation 


be 

b7C 


SSmSMIHQFOm 

RECO RD 66F-HQ-141Q162 b7C 

Hi | I 

As promised, please find attached the Accreditation h nundatv drawing for the DCS 
mission statements for the respective systems such a^ | DCS-3000, 

Manager. 



ilude the LoC's and 
ind Workflow 


b2 

b7E 


' uhKI V^D KH UIIII. U-J FUK eiaaejfi^ggnJ^a^j^jatodj^ l umlifii CUUrWirlntelllgeace Invefttlaatlons 
lSS§ET//NOFORN 


"Slit^lVbD h 'UUWI. O'J I Bf^eeejgcaflQ i^aMldaJa ^j^ ruiMlyn CUUIltai'lii kllig ence investi g ations 

nm ifrnrY uH.2ui3ULi; — 

5ECRE T//N 0F0RN 
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DECLASSIFIED BT 6S179DHAH/ESR/IIAJ 
OH- 06-05-2007 
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Mission Statements; 

DC^SOOO 

(U) DCS-5000 is intended to monitor, exploit, and disseminate intelligence from 

Torwgn Intelligence Surveillance Act (FISA) electronic surveillance in a collaborative 
environment among linguists, case agents, and case managers. The system will provide 
these services in Field divisions and FBIHQ. 


(U)- 


Wwk Flow Manager (WFMl 

Workflow Manager is subsystem of the DCS-5000. It is intended to provide 
centralized workflow management for field offices and FBIHQ. In field offices where 
there is a capability shortage for certain languages, Workflow Manager provides 
management for the distribution of translations, statistics on translation backlogs, 
translation completed and inter-office work transfers. 


(SI 



(U) 


b2 

b7E 


b2 

fo7E 


(U) The DCS3000 application suite was developed to assist law enforcement agencies 
(LEA) with collecting and processing data fi)r court-ordered ELSUR operations. The 
DCS3000 was developed as an interim solution, which is intraided for use until 
commercial collection platforms are available. It is a dedicated system with no 
connectivity to other networks and for which all users (i.e., FBI, DEA, and LEA 
personnel) have clearances equal to or higher than the data passing through system. In 
addition, dl users are authorized access and have the need-to-know for all data passing 
through the system. 

To conduct court-ordered ELSUR operations, LEA personnel dial into switches, which 
are devices used by telecommunications service providers to route telephone calls to their 
destinations. The DCS3000 can collect ELSUR data under the following warrant types: 

Pen Register: Deals with call data 06-05-2007 

Title Dl: Deals with call data and content classified by 65 i 79 dmh/ksE/maj 

PEASOIT: 1.4 (G) 

I I DECLASSIFY OH: 06-05-2032 

Ss tf n will provide a uniform approach to all ELSUR data management and analysis 
activities supporting all field offices. Such an approach is necessary because no single 
system that is curren tly deployed interfaces to multiple collection systems and databases. 

In addition j | will provide a common interface to these multiple collection systems 
and will endble a user to a ccess the data generated/processed by any collection system 
located in any field office. I N il also be the source of ELSUR information to 


SECRET/jWOFORN 


ALL IHFOPIIATIOH COHTAIHED 
HEBEIH IS TJHCLA3SIFIED EXCEPT 
WHEPE SHOOT OTHERTJISE 
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?ECRET/]T>fOFORW 


enterprise-level case management and intelligence aggregation systems (e.g., Virtual 
Case File). 


[ mission is to monitor the operational availability of the national security 
electronic surveillance (ELSUR) systems deployed to the field. These systems are used 
to collect court-ordered intercepts of telephony information. These systems also provide 
the capability to analyze the information and/or provide it to the appropriate location for 
further analysis and dissemination. 

The specific objectives of th J l are to provide the following capabilities on a 24x7 

basis: 

1 . Help desk support to all field offices with collection systems 

2. Monitoring and reporting on the health of Central Monitoring Plants (CMPs) to 
include the status of temperature, power, humidity, and pressure 

3. Monitoring and reporting on the health and performance of collection systems 
installed within the CMPs 

4. Remote troubleshooting and resolution of identified system problrans 

5. Prompt generation and maintenance of Recommended Operating Procedines 

6. Maintenance of a knowledge-based database containing failure and recovery 
information 

7. Facilitation of a prevrative maintenance program 

8 . Facilitation of contingency operations for the field and TICTU 

9. Facilitation of increased communications between the field and Engineering 
Research Facility (ERF) Technology Managers regarding system problems and 
deficiencies and their associated resolution 
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Message 


Page 1 of 2 


tRMD) (FBI) 

From: | l oTD) (CON) 

Sent: Wednesday. September 1 4. 2005 4:49 PM 

To: I k SecD)(CONl 

Subject: RE; DCS-5000| ^comments Part 2 


SENS ITIVE but unclassified 
NON-R ECORD 


bb 

-b7C 


foe 

b7C 


□□ 


We've been in a meeting all day. We've just gotten out. I've rea d "V equirements. I will 

continue working the SSP Appendix tomorrow. Stop by when you have time and I’ll let you know where 



JSecD) (CON) 

^4, 2005 4:42 PM 
rOTD) fC QNt 

FOTD) (FBI) J 

(CONl ^ 1 

Subject: DCS-5000| [comments Part 2 


be 

b7C 


]{OTD) (CON) i l (SecD) 


SEN SITIVE BUT UNCLASSIFIED 
NON- RECORD 


h2 

b7E 


More of the same ;-) 

9. Page 16, Section 3.9.1 add: 

Phone lines unciassified N/A I I 

DCS-3000 SBU FBi | | 

Elsewherel lask s ahoiiil I In various drawings i have seen ] t s used to connect 

I I is this still the case? If so, this will also need to be added here and the appropriate 

nppie etrects. 

10. Page 17, Section 3.9.2. After ”ISSO" add ", sit e ISSO s or their alternates". Add a note stating that the 
inspection of the special attention is needed for th ^ f ines to the TIU. 

b 2 11- Page 1 7, Section 3.9.3 Jhaapenlng statement is Incorrect. DCS-3000 and the | j connectlons are 
interconnections. Replacej [with "FBI". 

12. Page 17, Section 3.9.5. Include the | [ lines. 

1.3 Page 17. S action 3.9.B. Remove the last sentence in the second paragraph. Il | [ is connected 

I I document v\4iat data crosses that connection. 

14. Page 19, Section 3.9.9. Remove DCS-3000 as an indirect connection. 


b2 

b7E 


b2 

b7E 


4/13/2007 


ALL IHFORHATIOIJ COUTAIHED 
HEREIN IS UNCLASSIFIED ■ 

DATE 06-05-2007 BY 65179DHAH/K3R/MJ 




Page 2 of 2 



1 5. Page 20, Section 5.3 part b. What does "AgeoQuefBLto"? This question also applies to page 28 

Section 7.3.1 1 . It almost looks like "agency" is I term and in our case would be Field Offices, 

Resident Agencies and/or users. In part c add "TCP". 

16. Page 22, Section 7.1. Replace entire section with a reference to the Risk Management Matrix. 

17. Page 23, Section 7.2. 1. Which syst ems on the system diagram on page 42 in Attachment D Is the 

domain controller and the | P 

1 8. Page 23, Section 7.2.1. Note that each ISSO has their own account with ISSO privileges. 

19. Page 23, Section 7.2.1. In the last paragraph in this section needs to state the FBINET workstations 
and domain controllers are not connected to DCS-SOOO. Does DCS-5000 use FBINET user names? You 
could also add a note that at each users workspace is a DCS-5000 workstation and a FBINET workstation. 

20. Pages 23, 25, 27, 28, 30 and 31. Sections 7. 2.1. 7.2.2, 7.2.6-9, 7.3.5, 7.3.7, 7.4.1, 7.6.1 and 7.6.3. 

Include details as needed for i ^ squipment. 

21. Page 27, Section 7.3.9. In the last sentence change "that" to "who". 

22. Page 27, Section 7.3.10. Replace the contents of this section with "N/A". 

23. Page 27, Section 7.3.1 1 . What does "prior clearance allows" mean? 

Sorry I did not get further with this today as I am also have two other systems that are active right now. I 
am er^ecting to be at Quantico tomorrow and hopefully we can get together and hammer this thing into 
submission. 
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Freedom of Information 
and 

Privacy Acts 


FOIPA# 1056287 and FOIPA#1056307-1 
Subjects: DCS-3000 and RED HOOK 
File Number: DIVISION CDS 
Section: 14 



Federal Bureau of Investigation 
(FBI) 

Quarter 2004 


Plans of Action and Milestones 


DATE: 06-05-2007 

CLASSIFIED BY 65179 DEIHyTAH/K3R/JB 
PEASOH: 1.4 (g) 

DECLASSIFY OH: 06-05-2032 
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:CRET 



#1056287-000 


ALL IHFORHATIOII COHTAIMED 
HEREIIJ IS OTCLASSIFIED EXCEPT 
TiJHERE SHOW OTEIERWISE 


( 1 ) 




Project ID: CA2002-070 Assessment/System Name: DCS 3000 - Data Collection System 3000 Security Costs: $0.00 


Weaknesses POC Resonrees 

Required 

Scheduled 

Completion 

Date 

Milestones with Completion 
Dates 

Milestones 

Identlfled 
In CFO 
Audit or 
other 

Status 

Inadequate audit retention and review 
procedures 

12/01/2004 



C&A 

In Progress 

Project ID:CA2002-072 Assessment/System Name: DCS 6000 - Digital Storm Security Costs: $0.00 

Weaknesses 

POC 

Resources 

Required 

Scheduled 

Completion 

Date 

MUestones with Completion 
Datts 

Milestones 

Changes 

Identmed 
in CFO 
Audit or 

review? 

Status 

Establish and document standard physical 
access requirements for deployed systems 
within 90 days. 



12/01/2004 



C&A 


Implement fonnal Change Management In fire 
interim, ensure all sites have an emergency 
repair (fek that reflects the origirtal 
configuration in addition to backup tapes. 

1 


12/01/2004 

b7C 


C&A 


Implement a weekly security review to existing 
audit procedures. The Program Maitager 
and/or the ISSO should review the Rules of 
Behavior and maintain signed copies for all 
users within 90 days. 

Project ID:CA2003-008 Assessmeni 

1 1 

t/System Name: DCS NET - 

12/01/2004 
Digital CoUectio 

n Systems Network 

Security Costs: $( 

C&A 

).00 


Weaknesses 

POC 

Resonrees 

Required 

Scheduled 

Completion 

Date 

Milestones with Completion 
Dates 

Milestones 

Identified 
In CFO 
Audit or 
other 

Status 


S^ET 


( 2 ) 






For Official Use Only 


Implement banner text. 

ISSO 


6/15/2004 



CdfcA 


Implement techmcal password controls. 

ISSO 


6/15/2004 



C&A 


IS SO Training. 

ISSO 


6/15/2004 



C&A 


Obtain software through proper procurement channels. 

ISSO 


6/15/2004 





Remove/Disable modem. 

ISSO 


6/15/2004 





Test and Apply OS and Application Software patches. 

ISSO 


6/15/2004 





Verify security labels. 

ISSO 


6/15/2004 



C&A 












Project ID: CA2002-072 AMcssmentSystem Name: DCS 6000 -Digital Storm 


’ 




C&A 


Implement formal Change Management. In the interim, ensure | | 12/01/2004 

all sites have an emergency repair disk that reflects the original F r 

configuration in addition to backup tapes. | | 

C&A 



Project ID: CA2003-008 


Assessment/System Name: Digital Collection Systems Network (DCS 

NET) 


-mM 


MPkwim I iTirtfr 
rtimfts In I III 
I Amliliir 


For Official Use Only 

( 3 ) 





For Official Use Only 


Implement banner text. 

ISSO 


6/15/2004 

1 

1 

1 C&A 


Implement technical password controls. 

ISSO 


6/15/2004 



1 C&A 


ISSO Trainir®. 

ISSO 


6/15/2004 





Obtain software through proper procurement channels. 

ISSO 


6/15/2004 





Remove/Disable modem. 

ISSO 


6/15/2004 



C&A 


Test and Apply OS and Application Software patches. 

ESSO 


6/15/2004 



C&A 


Verify security labels. 

ESSO 


6/15/2004 



C&A 












Project ID: CA2003-008 Assessment/System Name; Digital Collection Systems Network (DCS 



For Official Use Only 

( 4 ) 









Eteta Collection System 3000 
(DCS 3000) (aka CALEA 

Law Enforcement Act)) 

od 

s 

^TO 

5/29/2003 

FBI CIO 

Director 

5/29/2M3 

5/28/2006 

DCS3000 application suite was developed to 

collecting and processing data for comt-oidered 
electronic surveillance (ELSUR) operations. 

Data Collection System 5000 
(DCS 5000) 

GG 


In Process 


FBI CIO 

Director 



The system supports the FBI's couit-anfriorized 
Electronic Surveillance needs for telephony and 

Data Collection System 6000 
(DCS 6000) (aka Digital Storm) 



ATO 

5/30/2003 

FBI CIO 

Director 

5/30/2003 

5/29/2006 

DCS 6000/Digital Storm provides the means by 
which the FBI collects, stores, transcribes, and 
reports Electronic Surveillance (ELSLTR) 
informatbn in a(x:ordance wifri the U.S. Code 
Title III. 

Digital Coflection Systems 
Network (DCS Net) 

GG 


lATO 

3/5/2004 

FBI CIO 


3/5/2004 

7/3/2004 

Network: to transport CALEA data traffic, bofri 
CDC and streamed CCC, fi-om the service 
provider sources to FBI Field Office destinations, 
where it will be collected. 

Document Control S^rtem (DCS) 

GG 

Sol 

D 

ATO 

4/9/2003 

FBI CIO 


4/9/2003 

4/8/2006 

RMD is responsible for both electronic and 
hardcopy (tocument record keqjing within the 
FBI. DCS provides the capability to perform 
hard cop^ document traddng of all documents 
which have been iq)loaded in electronic form into 
the Electronic Case File (ECF 


GG 

PL-2 

ATO 

3/26/2002 

FBiaO 

Director 

3/26C002 

3/25/20( 











Electronic Document Entry (EDE) 

GG 

D 

ATO 

2/27/2003 

FBiaO 


2/27/2003 

2/26/2006 

Web interface to ACS. 

ElectKmic Key Management 
System (EKMS) 

GG 


ATO 

4/22^2002 

EBiao 

Director 

4/22/2002 

4/21/2005 

key. 

Enterpiise Security Operations 
Center Phase 2 (ESOC Phase 2) 

GG 

D 

lATO 

5/11/2004 

FBI CIO 


5/11/2004 

9/8/2004 

"Monitor aiul protect the FBAs information 
systems from external attacks and insider misuse, 
and assure the availability, confidentiality, and 
non-r^mdiation of FBI infcnmaticm. " 

Enterprise Servers (aka 
(Mainframe Systems— Admin and 
^vestigative)) 

GO 

S 

: ATO 

3/11/2004 

FBI CIO 


3/11/2004 

3/11/2007 

systems support for 28,000 plus users located 
throu^out FBI HQ and Field Offices. The 
Enterpiise Servers operate year round, 24-houni a 
day, 7 days a week. 

Explosive Reference Tool 
(EXPeRT) 

GO 

S 

ATO 

6/21/2004 

FBI CIO 

Director 

6/21/2004 

6/21/2007 

Exfdosives Unit is responsible for maintaining 
die FBI's explosives reference database. 

Fastmoney 7. l/Squirmish 

GO 

D 

InIWs 


FBiaO 

Director 



Provide a means to remotely receive audio 
information for collection. Part of DCS. 

FBI INTERNET 

GO 

D 



FBI CIO 




llie mission of these systems is to deliver pubEc 


FOR OFFIcfAL USE ONLY 

( 8 ) 




(aka AMAPP) 

Interface 100 (C(-100)(al 


Correspondence Management System (CMS) (al 


Criminal Intelligence Information Sy^em (CMS) 
Critical Reach (aka IRAK) 

Cryptoanalysis Initiative Computer Net (Cl NET) 


(si[r 


Data Collection System 5000 (DCS 5000) 


Denver Sq13lnt 




For Officiai Use Only 
CVST Approval Granted Req. IOC Effort Type 
ASD Original 


ITOD 

CIRG 


Sensitive But Unclassified 


Top Secret SCI 
Sensitive But Unclassified 


OlO Operate 
ITD Operate 


Onginal 

20-Feb-04 1».Fefa-07 Original 

Original 

3(KJuM)3 30-Jaiv04 Original 

06- Feb-04 05-Aug^4 Original 

Original 

Original 

20-AugO1 19.Aug4)4 Original 

07- May-03 07-May-06 Original 


14-Jun-04 13-Jun-07 Original 

27-Feb-03 27-Feb-06 Original 

29- May-03 28-May-06 Original 

Original 

30- May^03 29-May-06 Original 


Sensitive But Unclassified 


Original 

Original 



Undergoing Certification 

Registered 

iRegistered 


tyednesday, Sqitember IS, 2004 


For Official Use Only 
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DIS Workstation Software Installation Instructions for 
Ver3.17 
Using JAZ Disk 

Load DIS Software From Jaz Drive Platter 

The Iomega Jaz drive is identified as /dev/dsk/cOtldO. The ‘ti’ represents the SCSI Unit 1 
hardware address. This identifier must be changed when a different unit number is used. Either 
a 1GB or a 2 GB Jaz drive can be utilized for installation. 

Note: The SCSI adapter must be configured so that tl and t2 (Jaz drives) 
have a maximum transfer rate of 10MB and the ‘SCSI Ultra’ mode 
has been disabled. This is new with Ver 3.17. 

For initial installation of tiie DIS software, steps a, b, c, d, g, and h should be omitted. The 
complete procedure assumes a previous version has been installed. 

a. Close any active sessions that may be running 

b. Eject all Jaz platters 

c. Select the ‘OS Access’ button and move the new window to another part of the 
screen. 

Note: If the ‘OS Access’ button is not visible, then this workstation is not the 
‘master’. The following steps must be performed: 

Select ‘Shutdown’ from the main DIS window 

Wait for system to stop 

Disconnect system from network 

Reboot workstation 

Go back to the beginning of Step c. 

d. Select ‘Shutdown’ on the main DIS screen 
(The system is now ready for software installation) 

e. Become root 

> su root 

> passwd; (password) 

f. Make the Jaz media available. Insert the platter into the drive set for SCSI Unit 1 
(also identified as Target 1, or as the ‘Bulk’ drive). 

# mount /dev/dsk/c0tld0s2 /opticalO 


l^nplnnfifiafl - Sensitive 


T 





g. Remove previously installed version, if present 

# cd /redhook 

# pkgrm redhook 

(answer ‘y’ or default when prompted) 


h. Ensure all previous data (if any) is removed from the system. 

# rm -rf /redhook/* 

i. Install the DIS software application package 

# pkgadd -d /opticalO redhook. usa 

-OR- for Canadian version: 

# pkgadd -d /opticalO redhook. can 

(answer ‘y’ or default when prompted) 

Note: If the message “The following files are already installed on 
the system and are being used by another package: 

/etc/ format.dat” is output, answer ‘yes’ to the “Do you want to 
install these conflicting files” message. 

j . Free the optical platter and Reboot 

# umount /opticalO 

# reboot 

Remove Jaz media. 

k. Reconnect the Network, if the workstation was removed from the network in Step c. 

l. The DIS Workstation is now ready for use. Previously entered session information 
must be reentered. 


Optional Quantum DLT7000 Tape Drive Setup Procedure 

The Quantum DLT7000 digital tape drive can be utilized with the DIS system. The drives are 
assumed to have been installed as SCSI target units 4 and 6. 

Solaris X86 Desktop, Ver 2.5.1, Driver Update 1 1, or Ver 2.6, Driver Update 2, from Sun 
Microsystems, is required. 


Llnrlassified - Sensitive 


SE6RFT 




1 . After the hardware has been successfully installed, reboot system, if not already done. 

2. Load the DIS software application. 

3. Login as ‘manager’ . 

4. Select ‘ OS Access . . . ’ button and select the OS window. 

5. Set DLT tape operational mode by entering: 

cdi /redhook/bin 

cp -p redhook.tape redhook.sh 

Note: To disable DLT tape operations, enter: cp -p redhook.nom redhook.sh 

6. Quit the ‘OS Access. . . ’ window. 

7. Select the ‘Shutdown’ button to reboot the system.. 

8. After the system completely boots, tq>e operation can be verified by observing the 
presence of the ‘Tape Media. . .’ button on the main ‘Manager’ window or the main 
‘Agent’ window. 




^3(^ET 


(Preserve Data) 

This message may not be displayed. 

(Automatically Layout File Systems) 

Manual layout 

(File System and Disk Layout) 

Customize 


Document No. 190974 
Revision!*] 
August 25, 1998 - 


(Customize Disks) 

Note: Change the partition table values to match either of the tables below. 

Based on the actual physical size, the warning message "Rounding Error” 
may be displayed. This message can be ignored 


B 

D 

B 


Table 3 - Single 2GB Oriye System Partition Information 

for device /dsk cOtOdO 


Partition 

Identifier 

Size 

0 

/ 

150 

1 

swap 

128 

2 

overlap 

2156 

3 

/export /home 

100 

4 



5 



6 

/usr 

200 

7 

/redhook 

1577 


{automatically 


{all available 


set) 


space left) 


(File System and Disk Layout) 

Continue (when above steps are completed) 

(Mount Remote File Systems?) 

Continue 

(Profile) 

( Displays information, similar to:) 

Installation Option: 

Initial 

Boot Device: 
cOtOdO 

Client services: 
none 

Software: 

Solaris 2.6, 

End User System Support 


SSffRFT 
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File System and Disk Layout: 


/ 

cOtOdOsO 

150 

MB 

swap 

cOtOdOsl 

128 

MB 

overlap 

c0t0d0s2 

2156 

MB 

/export /home 

c0t0d0s3 

100 

MB 

/usr 

c0t0d0s6 

200 

MB 

/redhook 

cOtOdOs? 

1577 

MB 


Begin installation 
Auto Reboot 

(Information) 

(Remove ^Solaris 2.6, Driver Update 3 BOOT Disk') 


(Installing Solaris - Progress) 

Note: This step takes about 15 minutes. A progress indicator is displayed. 

Note: The diskettes used in the following several steps must be write enabled. Should 
a ‘read only' disk be used, an error message is displayed. Write enable the 
floppy, re-insert, and press <enter> to continue. 

Insert ‘DU3DT diskette (Solaris 2.6 x86 Driver Update 3 Diskette 1) when prompted in the 
Console window. 

Note: Be sure the mouse is located in the 'Console Window' and the window has been 
selected. 

(press enter) 

If prompted to, insert 'DU3D2' diskette (Solaris 2.6 x86 Driver Update 3 Diskette 2). 

(press enter) 

If prompted to, insert 'DU3D3' diskette (Solaris 2.6 x86 Driver Update 3 Diskette 3). 

(press enter) 

Remove any diskettes that may be in the drive. 

The system will start application software installation using the 'Solaris Install Console’ 
window. This window can be resized for easier reading. The application installation will take 
about 5 minutes. 

The message 'Additional Update Diskettes to install (y/n) [y]’ is displayed. 

Note: The Video Driver Update diskettes must be write enabled. 
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(Preserve Data) 

This message may not be displayed. 

(Automatically Layout File Systems) 

Manual layout 

(File System and Disk Layout) 
Customize 


Document No. 190974 
Revision [-1 
August 25, 1998 


(Customize Disks) 

Note: Change the partition table values to match either of the tables below. 

Based on the actual physical size, the warning message “Rounding Error” 
may be displayed. This message can be ignored 




Table 3 - Single 2GB Drive System Partition Information 

for device /dsk cOtOdO 
/ 

(automatically set)5(S3^ 


m I'ifo nyf, 

(all available space- left) 

^ 


(File System and Disk Layout) 

Continue (when above steps are completed) 

(Mount Remote File Systems?) - . 

Continue 

(Profile) 

(Displays information, similar to:) 


Partition 

Identifier 

Size 

0 

/ 

150 

1 

swap 

128 

2 

overlap 

2156 

3 

/export /home 

100 

4 



5 



6 

/usr 

200 

7 

/redhook 

1577 


Installation Option: 
Initial 

Boot Device; 
cOtOdO 

Client services: 
none 

Software : 

Solaris 2,6, 

End User System Support 
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File System and Disk Layout: 


/ 

cOtOdOsO 

150 

MB 

swap 

cOtOdOsl 

128 

MB 

overlap 

c0t0d0s2 

2156 

MB 

/export/home 

c0t0d0s3 

100 

MB 

/usr 

c0t0d0s6 

200 

MB' 

/redhook 

cOtOdOs? 

1577 

MB 


Document No. 190974 
Revision H 
August 25, 1998 


Begin installation 
Auto Reboot 

(Information) 

jRemove 'Solaris 2.6, Driver Update 3 BOOT Disk*) 
Ok 


(Installing Solaris - Progress) 

Note: This step takes about 15 minutes. A progress indicator is displayed. 

Note: The diskettes used in the following several steps must be write enabled. Should 
a ‘read only' disk be used, an error message is displayed. Write enable the 
floppy, re-insert, and press <enter> to continue. 

Insert ‘DU3D1’ diskette (Solaris 2.6 x86 Driver Update 3 Diskette 1) when prompted in the 
Console window. 

Note: Be sure the mouse is located in the ‘Console Window’ and the window has been 
selected. 

(press enter) 

If prompted to, insert 'DU3D2' diskette (Solaris 2.6 x86 Driver Update 3 Diskette 2). 

(press enter) 

If prompted to, insert 'DU3D3’ diskette (Solaris 2.6 x86 Driver Update 3 Diskette 3). 

(press enter) 

Remove any diskettes that may be in the drive. 

The system will start application software Installation using the ‘Solaris Install Console’ 
window. This window can be resized for easier reading. The application installation will take 
about 5 minutes. 

The message ‘Additional Update Diskettes to install (y/n) [y}' Is displayed. 

Note: The Video Driver Update diskettes must be write enabled. 
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11.3 Application Removal 

The PC PDU application is removed with the following procedure 

Terminate the PC PDU application, if it is executing 
Click 'Start' 

Click 'Settings' 

Click 'Control Panel' 

Click 'Add/Remove Programs' 

Select 'Redhook - PC PDU' 

Click 'Add/Remove' 

Click 'yes' 

Click 'Ok' 

Click 'Ok' 


Note: If any files were added to the installation directory, such as debug or 
trace output files, the directory will not be completely removed. This 
directory and any remaining files can be manually removed with 
Windows Explorer. 



SENSITIVE BUT UNCLASSIFIED 

3. SYSTEM DESCRIPTION 

3.1 Sumniary other out of scope 



The J3094 can also receive, via direct RS-232 cable connection, unclassified, downloaded call 
record information from the DCS-3000. The call records are processed through an 
acknowledgement (ACK) signal from the J3094 in order to send subsequent records. This ACK 
signal itself does not contain any call record or system information but is just an RS-232 data bit 
that acknowledges the receipt of the call record. other otit of scope 



3.2 System Diagram 



other out of scope 


SENSITIVE BUT UNCLASSIFIED 
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jbUT OF SCOPS 


SENSITIVE BUT UNCLASSIFIED 



3.5 Data Processed 


The J3094 collects pen register data from local or remote dialed number records, as well as via a 
one-way push from the DCS-3000. The DNR processes target activity and outputs the data in the 
form of ASCII comma delimited files. The J3094 receives these files and deposits them in a data 
base for future upload to the TA database via removable media. These files collected from the 
DNR’s consist of target number, telephone number, date/time of call, duration, and on/off hook. 



SENSITIVE BUT UNCLASSIFIED 

12 OTHER OUT OF SCOPE 








3.9.2 Connectivity Management Procedures 

The only connections of any sort involve those between the DNR’s and remote DNR’s to the J3094 
via telephone modem, for (he purpose of retrieving call data, as well as call records received via one- 
way push from the DCS-3000 via a RS-232 direct cable connection, using ACK signals. 



SENSITIVE BUT UNCLASSIFIED 







3.9.7 Telecommunications Security 

The J3094 does not interface with any other system, other than one-way receipt of call data from the 







SENSITIVE BUT UNCLASSIFIED 

|dCS-3000 I Unclassified | IAS [rS- 232 cable 


Data from this system is NOT shared or distributed to my other systems. 

Data stored on media created on or used on this iirformation system is distributed 
for use on the following system(s): 


SYSTEM NAME 

CLASSIFiCATIONS 

COMPARTMENTS 

ACCREDITED BY 

TRANSFER METHOD 

TA 

Unclassified 

IAS 

Floppy Disk 






Export of any data that is collected from the various systems is conducted on a daily basis. 
The user will search the database with the Call Record Analysis module and export the new 
files using the “Export to TA” file option. This option will format the selected data into a 
form that Telephone Applications will accept and give the user the opportunity to write this 
data to an external drive. The user will then remove the media and deliver it to the 
Telephone Applications workstation for upload. The media is then returned to the J-3094 
system for reuse or storage. 

4. HARDWARE 

4.1 Hardware Listing 

See Attachment F - Equipment List. 


4.2 Custom-Built Hardware 

N/A 

4.3 Configuration Management 

See paragraph on the 7.5.3 Configuration Management Program. 


5. SOFTWARE 

5.1 Software Listing 

See Attachment G - Software List. 


5.2 Configuration Guides 


SENSITIVE BUT UNCLASSIFIED 
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SENSITIVE BUT UNCLASSIFIED 


Attachment D - System Diagrams 



Accreditadon Boundaiy 


J3094 Accreditation Boundary 


SENSITIVE BUT UNCLASSIFIED 
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SENSITIVE BUT UNCLASSIFIED 
Attachment E - System Diagrams (Cont’d) 



J3094 Data Flow Diagram 

SENSITIVE BUT UNCLASSIFIED 
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For Official Use Only 


□ Counterterrorism Related System 

^ Operational System 

Network/System Name: J3094 

Former Designations (if applicableH 
Network/System Name: 



Information System 
Security Officer 

ITD 


91 


Registration Request 

Initial CA Effort 


C&A Documentation Status 

Phase 1 Not Started 


Authority To Operate Information 


Current Approval to Operate 

Not Specified 


Date Granted 



C&A Tier Level 1 

Confidentiality 

M 

Protection Level - ? - 

Integrity 

B 

> Operational Mode Dedicated Availability 

B 


Sensitive But Unclassified SCI Codes 

□ Foreig n Gov. Info 

|fblssemuiation.Cayeato 

□ NOFORN □ REL TO USA, 

□ fOUO P other 

Hf OIA EiemptioBs 

P Rule 6e P Federal Tax Info 

□ Privacy Act □ Other 


n 


System Conncclivily Ucc|iiirciiiciits (Lxlcrnal aiHl InU riial) - 


Internal data connection to the DCS-3000 system via the Cl- 100. Daily modem connection from J-1 1 56A-00 Remote Dialed 
I Number Recorder (RDNR). External connection to CMP based DNR’s 


I Hi icf iVlissioii Desci iplioii 


Brief Funciional Dcscriplio 


The 3094 collects ASCII pen register records from DNRs and the DCS 3000. FO’s perform a daily database search for new 
records and saves this information to a Telephone Applications di^ for upload. The system also provides a means of 
: — i_!_i j . — : — altcmativc to expensive leased and dial lines 



Headquarters 

M FBI Field Offices 

LI Multiple FBI Installations 

□ LEGATS 

13 Resident Agencies 

□ Task Force 

□ Off-Site 



Locations/Site List; 

I 1 Primary Location; 



I Specific Customer Uec 


Does the Application/Information System have a security policy developed for controlling access? 
Do multiple users access the Application/Information System? 

If the answer is YES, enter the number of users: 


I Sy.stcm Devciopmeiil 


C&A System Registration 


For Official Use Only 


pg-72 









□□□snnn 






NON-RECORD 


Original Mes«ane 

From! tOTD) (CON) 

Se nt; Tuesday. July 1?. 5:19 PM — 

To i t OTD) (CON)L 

Subject: RE: FY06 DRAFT Budget 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 

I put the amounts from the ! h omments spreadsheet in the "appropriate" spend codes. I also come up with a 
different total. Unless the FY06 budget changed, it should be $17M+. The S600K for DCS-3000 wasn't added to 
the total. Although I didn't change the spreadsheet, the software plan is only going to cost $4,150,000 instead of 
the original $4,600,000. 


—Original Messafle--— , 

From; | I fOTDl (CON) 

Se nt: Tuesday. July 12. 200 5 3:06 PM , 

To i r OTDl (CON H r OTDI (FBI) 

Subject: FY06 DRAFT Budget 
Importance: High 


Attached are the figures I ended up with. I have NOT passed this tol 


until you have blessed it 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE B U T UNCLASSIFIED 


ALL lETFOraiATIOII COHTAIHED 

HEBEIII IS OTCLASSIFIED 

DATE 06-14-2007 BY 65179DHH/K3R/LHF 


10/4/2006 



— Ortginal 

From: 

Sent: 

To; 

Subject: 



UNCLASSIFIED 

NON-RECORD 


b6 

b7c 


Can you give me the total number of deployed dcs-3000 systems? I only need to know what is currently fielded. 


Thanks, 



ALL IHFCiPI'IATIODr COMTAIHED 

HEP£BI IS rafCLASSIFIED 

DATE 06-14-2007 BY 65179DHH/KSR/LHF 


V 


¥ 



• Importance of lAPSystemlD and Location 
Parameters 

- Combiriatlm<<IAPSy«emlD and tealinnuriiquoly identify 
the cel site 

- CDMABcempie 






1-A 
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DCS-1020 

Software Installation and Users Manual 



Version 2.5 
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Wireless Intercept and Tracking Team 
DATE: 06-15-2007 Tracking Technology Unit 

CLASSIFIED BY 6 S 179 diBh/b 3 E/lme 
FEASOIT: 1.4 (G) 

DECLASSIFY ON: 06-15-2032 


ALL INFOPIIATION CONTAINED 
HEREIN 13 UNCLASSIFIED EXCEPT 
TOHEEE 3HO™ OTEIERNISE 
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Version 2.5 
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1. SCOPE 

This installation manual will inform the user on how to install the Van Integration, also called 
DCS- 1 020, application. It will also describe the features of the system and how to use the DCS- 
1020 application. 

2. SYSTEM OVERVIEW 

The DCS- 1020 system was developed by the Operational Technology Division to provide real 
time cell site location information to mobile Wireless Intercept and Tracking Team (WITT) 
vehicles and complement other cellular tracking tools. The system architecture is illustrated in 
Figure 1. 


DCS-1020 System Architecture 



Figure 1. DCS-1020 system architecture 


The information delivered to the WITT vehicle is derived from intercept information collected 
by the DCS-3000 pursuant to a location enhanced pen-register order and includes the cell site 
identifier, switch identifier, time stamp, cell site latitude and longitude, sector orientation, and 
sector size. The DCS-3000 system must be preconfigured to deliver information to the DCS- 
1 020 system on a per target basis. This configuration process is outside the scope of this 




Van Integration/DCS10-20c 



Version 2.5 


document and should be coordinated with the technical staff responsible for operating the DCS- 
3000 in your office. 


3. INSTALLATION 

Before installing any components of the Van Integration system please check the following 
settings on the laptop; 

Remote Access Manager ON 

• Go to Control Panel. Select Administrative Tools. Select Services. Right click 
on Remote Access Connection Manager. Go to Properties. Set startup type to 
Automatic. 


Cryptographic Services ON 

• Go to Control Panel. Select Administrative Tools. Select Services. Right click 
on Cryptographic Services. Go to Properties. Set startup type to Automatic. 

FIPS Compliance OFF 


• Go to Control Panel. Select Administrative Tools. Select Local Security Policy. 
Select Local Policies. Select Security Options. Right click on System 
Cryptography: Use FIPS compliant dgorithms for encryption, hashing and 
signing. Go to Properties. Select Disable. 


3.1 Wireless Internet Card (AirCard) 


IiKtall the| 

requested). Uo not insert the AirCard device in the" computer until the s oftware been 
comp letely installed. When installing wireless Internet cards other than th^ | 

I I please follow the specific installation instructioiu for the device. 

3.2 Microsoft MapPoint 

Install Microsoft MapPoint Software (2 CD set) and use the default settings. 


h2 

hlE 


3.3 DCS-1020C 


Insert the Van Integration CD (a.k.a. DCS-1020C) into the computer CD-ROM drive. To install 
the software run the following program located on the CD; 

dcsl 020-install.bat 
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4.3 Configure the DCS-1020C Settings 

Launch the DCS 1020 application (a shortcut should be on your desktop after the installation). 
Verify the Server settings are correct by clicking on the Configure from the top menu in the 
DCS1020C window, then choose Server Options. 



4.4 Set the Target Numberfs) 

Enter the Target's CALEA CaselD by clicking on Configure from 
the top menu, then Target Options. The Target CaselD must match 
the CaselD in DCS3000, which is defined by the carrier. You can 
enter multiple CaselDs co vering mul tiple Target numbers For 
example, in cases where a I Itoget roams onto the l 

network the CaselDs used b j | will likely be 

different. In this case, each CaselD must be provisio^d in the 
Target Numbers window in order to successMly monitor the 
target’s location. 

b2 

hlE 


4 




Attached is a quick slide for the DCS3000. Oo you think a graphic would be better than listing all the application 
names? 



DCS3000.ppt (211 
KB) 


SENSITIVE BUT UNCLASSIFIED 


ALL IHTOPmTIOIT COHTAIHED 

HEEEBI IS Ul-CLASSiriED 

DATE 06-14-2007 BY 65179DIE/KSR/LHF 






From: 

Sent: 

To: 

Cc: 

Subject: 


](OTD)(CON) 


□ (OTD){FBI) 


FrlHaif Sontomhor 1 5 , 2006 4:30 PM 
1 ^OTD) (FBI) , 




:0 T D)( P BI) 

IS-5000 Wkly HiLites (9/1 1/06 - 9/15/06) 



foe 

b7C 


3oTD) (CON)C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Accomplishments - 


Development - 

• ERF Disaster Recovery Back-ups - Approx. 25% of the RW system components still need backing-up by ghost 
imaging hard-drives. Customization techniques are required to complete this task due to non-standard hardware 
components. 

• RTIU Testing - preparations have been completed in order to evaluate bandwidth data of Arachnet, Windows 
Workstations, and Solaris Workstations. The reconfigured Solaris WS and Windows WS were tested and actual 
testing shail begin the week of 9/1 8. 

• Discussions continue between ERF and RTN in order to finalize the architecture specifications required for the 
development of the ADS/WebServer/WWS/Disaster Recovery Back-up. This is a work in-progress until the installation 
is implemented in the 1st Qtr CY07. 

be 

Filed Support/Logistics - fo 7 c 

• MS Security Patch "06-40" - Seventy CDs were delivered to the field Thisnatnh shall be installed on ALL Windows 

machines that TICTU supports (DCS-3000, 5000, 6000, Daemon) r I CSOC) infisrmed the field of the 

installation procedure and shall monitor and capture completion status, me estimated completion date has not been 
determined. 

• KC is still experiencing problems with the RW system - failures: ring detection, no caller ID detection 

• Duplicated the set up on ERF2 system, but we were unable to duplicate the failure. ERF/RTN talked to the site 
with recommended modifications to settings. No improvements were made after incorporating mods. We have 
exhausted all ideas at this point. Should somebody go to the site? 

• LA is experiencing RDNR "Store and Fonvard" problems with the RW system. Caller ID bursts aren't being captured 
on the RW. We will contact the site to gather additional information and try to determine the problem. 

• Norfolk is still experiencing Achieving problems. RTN is working with the site to gather more information. May need to 
send RTN to site. 

• OWP field issues continue to be identified. The issues cause inconveniences to Linguist, case agents, and system 

administrators. Solutions to the identified issues are being investigated by TICTU and RTN. j 32 

g • ERF was contacted by RH stating that the corrections made last week on the problem I l is now working. b7 e 

• A meeting with NYC I I is scheduled ftw Tues (19SEP06) at ERF-E to discuss System#4, 

ADS/WWS Plans, rerent RS failure (no alarm detected) - nothing was collected for a period of time, CALEA issues, 
etc. 


Contracts/Admin - 

• RTN meeting 18SEP06 to reconcile Pos/TORs in order to determine remaining balances for future expenditures 

• Still working with RTN to update CLIN Lists 

• Awaiting RTN is proposal for hardware replacement for ADS equipment. The equipment order is required for ADS 
deployment. 

• Efforts continue to bring in additional resources. 


! " ~| s hall be on AL from 9/25/06 - 9/zm. 


J^W Security Upgrade at HN (9/21/06 - 9/27/06). 


ALL IirFOPHATIOH COMTAIIJEI) 

HERElif IS lUCLASSIFIED 

DATE 06-14-2007 BY 6.5179DHH,/KSR/'LHF 


From: 

Sent: 

To: 

Subject: 


I blD) (CON) 

^'Wednesday. June ijU Ub 11:13 AM 

I ^ TDUCON) 

RE: FY03 & FY04 Planned vs. Actual • 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Thanks 


— Original — 

From: I l oTDIfOONI 

Sent: 

To: I IrOTDI fCON) IK-7,- 

Subject: ' PV03 Hi PV04 Planned ^.Adual 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


FV03 

DCS5000 


DCafcQQQ 


b2 

b7E 


DCS3000 

Planned $4,154,638 
Actual $4,116,667 


FV04 

I [)CS5Q0Q 


b2 

b7E 




DCS3000 

Planned $3,535,507 
Actual $3,525,469 


c 


>TS/-nCTU 


□ 

? 


b6 

b7C 


b2 


OTD/es 

(O) 703J 

(F)703[ 


ALL IliTFOPIIATIOir COHTAIHED 

HERED: is OTCLA33IFIED 

DATE 06-14-2007 BY 65179DHH/'KSR,/LHF 





M • 


From: 

Sent: 

To; 

Subject: 


"](OTD) (CON) 


})TDKCON) 


, Mpfidav. Jung IS. 2Q06 1P--29 am 

l". t OTD^ (CON) 

FW: ITAB Briefing Schedule {& Template) 


UNCLASSIFIED 

NON-RECORD 


FYl... 

HiZZI 


I will need some input from you regarding the budget and timeline for the various phases for this presentation. I heard from 
I [today that the presentation date has been moved from September 21 to sometime in November. 


JCOTD)(CON) 

610:23 AM 
rt)) (FBI) 

JCOTO) (CON) 

FW: ITAB Briefing Schedule (& Template) 


I l(OTD 

\ ‘ 'TO 


b6 

b^C 


UNCLASSJFIED 

NON-RECORD 


Hl | I 

Here is the ITAB template. Whei l "Ig ets in tomorrow, 1 will see what PowerPoint presentations she has on the DCS- 
3000, DCS-5000 & DCS-6000 and (ry b incorporate as much as I can. 



UNCLASSIFIED 

NON-RECORD 

bTC 

Hi | I 

Thanks for your inquiry. 


Yes, the briefing is high-level. The ITAB members are all Assistant Directors - from all FBIHQ 
divisions. 

Attached is the template that the CIO established as the standard for all ITAB briefings. Use this as 
your guide and it is specific about the kind of information requested. 


ALL IFFOPilATIOII COHTAIMED 

HEBE Dr IS raJCLASSIFIED 

DATE 06-14-2007 ET 65179DHH/KSR/LHF 


[OTP) (CONI 





SENSITIVE BUT UNCLASSIFIED 






UNCLASSIFIED 


UNCLASSIFIED 


ALL IlfFOPmTIOir COIdTAIHED 

HEBEBI IS UIJCLASSIFIED 

DATE 06-14-2007 BY 65179IiHH/KSR/LHF 



UNCLASSIFIED 

NON-RECORD 


Please se j V mail below. Thanks. 



-—-Original M 

From: 

Sent: 

To: 

Subject: 

Importance: 


ess^o^ 


I CO-n»(FBQ 
^ 04, ^UUb xl;02 AM 


Immediate action required! 
High 


UNCLASSIFIED 

NON-RECORD 


[ please ftsrward to the Unit 
All, 

In an effort to answer a FOIA request, I am requesting that all TICTU employees and contractors immediately do a word 
search of their e-mail system (active and archived records) for the term “DCS-3000" and "DCS 30 00" and ' 'DCS3000" 
(variations of the same term). If a document or e-mail is located print it and bring the hard copy to | [f or compilation. 

1 need this accomplished ASAP. If there is a negative response - 1 need that also. 


s 




ALL IlfFOPmTlOII COHTAIHED 

HEEEIir IS TJ1JCLA3SIFIED 

[3ATE 06-14-2007 BY 65179DIffl;/KSR/LHF 




Electronic Surveillance Technology Section 
Operational Technology Division 
ERF Quantico 



202 1 T celi 


UNCLASSIFIED 







n (OTP) (CON) 


be 

b-7c 


From: 

Sent: 

To: 

Cc: 

Subject: 



RE: Immediate action required! 


]{OTD) (CON) 


UNCLASSIFIED 

NON-RECORD 


I have nothing related to the 3000 program. 

^ Albuquerque Field Lftice - Squad 12 
TICTU DCS-5000 Program 
BAE Sys tems - Inforirp Hon Tect 
Desk: S05| Fax: SOSf 




be 

b7C 



UNCLASSIFIED 

NON-RECORD 


Please see | | e-mail below. Thanks. 

’o TOESTS/'HCTU ^ 

70C___Z] 

— Original ^6 

From; I ~l (OTD) (FBI) b7C 

Sent: Wednesday. October 04. 2006 1 1 :02 AM 

To! I t OTD) (CX)N) 

Subject: immeaiate acoon r^uiredl 

Importance: High 


UNCLASSIFIED 

NON-RECORD 


please fonvard to the Unit 


ALL IirFORHATIOH COHTAIIOED 

HEREIIf IS U1ICLA3SIFIED 

DATE 06-14-2007 BY 65179DHH/KSR/LHF 


In an effort to answer a FOIA request, I am requesting that all TICTU employees and contractors immediately do a 
word search of their e-mail system (active and archived records) for the term "DCS-3000“ and "DCS 3000” an d 
"DCS3000" (variations of the same term). If a document or e-mail is located print it and bring the hard copy to| | 

for compilaWon. ^ * 

I need this accomplished ASAP. If there is a negative response - 1 need that also. k 7 V . 


irelecommunlcatione Intercept & Collection Technology Unit 

tlectronlc Surveillance Technology Section 
Operational Technology DMsion 
ERF Quantico 


Freedom of Information 
and 

Privacy Acts 


FOIPA# 1056287 and FOIPAM056307-1 
Subjects: DCS-3000 and RED HOOK 
File Number: DIVISION DOCUMENTS 
Section: 23 



Federal Bureau of Investigation 




From: I I (OTD) (FBI) 

Sent: Tuesday. August 29. 2 QQ6 7:42 AM 

To: I knTn\ ^fri\ 

Subject: FW: Cellular Issue 


SECRET he 

RECORD 212A-WF-224477 b7c 


□(CD) (FBI)C 


□(OTD) (FBI);[ 


^OTD) (FK) 


SECRET 

RECORD 212A-WF-224477 


I realized Friday night that there was an error in the numbers I provided you last week. Specifrcally, last week's number 
included target-days from the beginning of the intercept through 20060430. If the intercept started before 20050501 and 
was active between 20050501 and 20060430 the target-days data will be statistically flawed. So, I have re-run the 
numbers with a hard-limit on the start and stop dates. 


on 

T-50; Targets! [Target-Days I I Cosj. 

T-lll: Targets =1 ferget-Days=| pst=^ 

Pen; Targets =| farget-Days 4 I Cost = 


Total Cost for 1 year =F 


I 1 


Backer. Targete[^^ Target-Da ys I 
T-50: Targets 4 [Target-Days i j 

T-lll: Targets^ |Targets-Days| j 

Pen: Targets H [Target-Days J • 


b2 

b6 

b7C 

fo7E 


I am sorry for the earlier mistake; haste makes waste. 

□ 


— Original 

From! I l (OTD) (FBI) 

Sent! Thursdav. July 20;iS5rU:4^ ^ 

To: I ^(C0)(FBI)J I (OTD) rranl Irrm^ (FBI) 

Cc I T PB)TFBir'^ 

Subject: Kt: i^iiuiar issue 


19 




SECRET 

RECORD 212A-WF-224477 



I have numbers for i h at I believe are accurate. I processed ail the intercepted call records on 

our DCS-3000 system for both carriers for the period of May 2005 through April 2006. Here are the results; 


T-50; Targets|“n Target-Days^^^J C ost=l | 'Note these figures do not include Backer targets 

T-3: Targets^ raroet-Davs i l uo sti l~~7 

Pen; Tarqets I I Target-Davs t I Cos t! I 

Total Cost = 1 "1 *This cost does not include costs for Backer targets 

I 1 

Backer Targeted j Target-DaYSj__^ I 
T-50: Targetsl I Target-Days 

T-3; Targets=| rarget-DayS' 

Pen; Targets^ ! i Target-Davs l 

Total Cost = ? 


It is im 
with ej 

□ 


pssible for me to accurately calculate the l "l osts using the data from the DCS-3000 system since ! j 
Icosts are a function of the number of switches provisioned with the target. Since the number of switches vary 
h intercept order I cannot accurately calculate the cost. 


-nrininal MPTOinP 

From: I I tCDt (FBI) 

Sent: , Wednesday. Ju[Y,ig. 20 fl 6 10=50 am ^ 

J lrOTDj ^(FBn |^^ K OTP) (FBl) l | (OTD) (FBI) 

Subject: Cellular Issue 

SECRET b2 

RECORD 212A-WF-224477 b6 

b-rc 

hlE 

Hello Gentlemen - 

I |h as haon jiranninn thoir faof in getting back With US regarding the number of lines/targets we have with 

them, so I met will lo discuss the contracting issue. Here's what we came up with and would 

welcome your inpul. ’ 

Slnce l l as been slow in responding, let's start witt i i you indicated that you have a good 

relationship with them, (and they're starting to charge us) can you get an indication of coverage from them, 
regarding all o f our stuf f to include anything with the Bureau name on it (to include join t LE coverage etc) and 
Backer. Then I M n you pull from TMD what numbers you have wit h! I so we can compare the two. 

What we’re looking to do is get a snap shot of actual lines being used that we can verify. Then, what i T vill do 
is add a rider in the contract that will allow for an increased amount/coverage. What she is concerned about in 
getting into a big excessive contract with the carriers and then not using the service (i.e, paying/contract for 500 
lines and only using 300). 

They other thing we were looking to do to jump start this is to go through the government sales/marketing people 


20 




This task is wha l l urrentlv is i 

DCS3000 manual and CBT review, 
hardware configuration, and deployment support 


lurrently is assigned to. This task is for operations support, including TMD review. 



The attached report provides information related to the services provided during July 2006. 



ERF-E, 3rd Floor, Room# 3A43A 
Building 27944A, Quantico, VA. 22135 
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From: 

1 ^ ; 

j(OTD)(CON) 

Sent: 


8:41 AM 

To: 

1 ] 

bTD)(FBI) 

Subject: 

FW: 2007 Rescission 1 

mpact - SBIT 


UMOLAeCir tE& 

NON-RECORD 


pyr... 


OTP/g STS/TTCTU 
(O)7od I 

(F) 703| I 

— Original Me saqe — 

From: F lOTD) (FBI) 

Sent Tuesday. Julv'Ss. 2006 8 :32 AM 

To: I | tD)(CON) 

Subj«t 200/ Kesassjon impaa - SBIT 


W IOLAOC i r tBP 

NON-RECORD 


25% Impact -SBIT 

Due to current budget restraints, we are not fully utilizing the Booz Allen and Hamilton contract. Additional cuts would 
reduce the engineering service contract further. 

The amount of service from the BAE contract (empicyees) will be reduced. 

Purchases of technical equipment to support the operational needs of the field offices will be reduced. 

Our research and development effort, which enables us to be on pace with technology in toda/s world, will slow. 
Plans of redundancy for the DCS 3000 system will have to be put on hold. 


supervison* special Agent 

Telecommunications Intercept and Coiiection Technology Unit (TICTU) 

Electronic Surveillance Technology Section 

Operational Technology Division 

Qu antico. Virgi nia 

70- J 1 


U N CLA S 8IFIB B 


b6 

fc7C 
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■D)(FBI) 


From: 

Sent: 

To: 

Subject: 


I f r 

Pridav. June 09. 9:42 AM 

I (FBI) 

DCS-3000 Privacy Threshold Analysis 


SENSITIVE BU T UHOLAOa t P t C P- 
NON-RECORD 


Per o ur tel ephone conversation. Please see attached. 


Privacy Threshold 
Anal^is.wpd... 

^Thanksl I ^ 

Operational Technology Division 

Telecommunications Intercept/Collection Technology Unit 

AEGIS/OTD SEAC 

<^°= l ' I 


25 



26 




□OGQ(FBI);t 
t request-DAG ^ 




FW: Urgent r^uest-DAG ^ort-rusea m taswng 
High 


NON-RECORD 


This is a follow-up to my e-mail below (and to yesterday's e-mail from GC Caproni to ADs.) , wrtiich resulted In you folks 
being identified as the likely ticket holders for this action (due Friday). 


This is taken from a list provided me-l apologize for any misspellings. Also, if you're not the right person, please contact 
me ASAP to dime out who is. be 

I b 

I Will try to contact you by phone later today, but please feel free to call me first if you'd like (202-324-|__J As detailed 
below, actions require completion of at least one and maybe more Privacy Impact documents for the following systems for 
which I understand you are the POC. (I assume the ISSO probably has primary ticket, but this would be for ISSO and 
owner to work out.) 


Chemical Network; ISSO: ^ 
CJISWAN: ISSO: [[ 


3ystem Owner: Q 


Data Collection System 3000: ISSO;^ 
Financial Management System; ISSC[^ 


^System OwnerQ 


bb 

b7C 


I /System Owner: 


jSystem Owner; AD Perkins 


Field Office Integrity Security System ISSO: ?? (DAD Thomas) /System Owner AD Haynes |_ 
with request you ID ISSO or POC.) 


Jl’m sending to you 


lAFis issn-i y.g;vstem Dwnftr H ii.Q (Note; Please coordinate witll I 

I | who are already invoIvKi.) I I 

LEO ISSO: [ ^ ystem Owner | | (also I believ ei involved in PIA). 

XTS300 Controlled Interfaces ISSO: I I Sv ^tem Ownerlj |'m sending to you for 

help identifying POC since 1 didn't find any address fo j | ' 


Mes^^ 


□ (OGC)(F 



^NGbA66(HE& 

NON-RECOf^ 


This requests the assistance of the "To" addressees to meet a short-fused, very high-visibility DOJ tasking that 
the FBI received yesterday. The tasking relates to requirements by DOJ (passing down' requirements by OMB) 
that agencies must on a quarterly basis certify 90% completion (for edl FBI systems) of Privacy Impact 
Assessments (PIAs) required by Section 208 of the E-Govemment Act (E-Gov). To meet the two deadlines 

28 




From: 

1 l(OTD)(FBI) 

Sent: 

1 hursdav. June m 2(J0B 10:48 AM 

To: 

1 rOTH) (FBI) 

Subject: 

RE: Documents being sent to Ms| 

SENSITIVE BUT-UNG 


NON-RECORD 



• < iooc 


id job on this... 


[ 


Supervisory special Agent 
DCS Program Manager 



—Original Message--- ^ 

From; I l OTPI (FBI) 

Sent: Tuesday, June 06, 2606 1:58 PM 

' □(OTD) (CON) 


Cc 

Subject: 


(FB 

iments being sent to Ms. | 


SENSITIVE BUT- 
NON-RECORD 


be 
hi a 



Hope all went well at your meeting and the Dr. Appt.... 


I l and ad vised him tha t 
iMll oe sent to M j J b 


I spoke with Mr. I l and ad vised hii 
documentetion \Mll be sent to M: 
short deadline. 

(Please put a note on the email to Ms.| 
working on this issue). 

(Please have on the CC Mr. | | Mr | | Mr.. | j VIs. 


It we are working mi this proj ect and most of the requested 
|by COB today. Mr j l hanked us for doing a good job for such a 


ising that attached is what we have found to date and we are still 


land me... thanks) 


Further, I advised Mi jl ) of the other issue regarding the Privacy Impact Assessments (PIA) and DCS-3000, and 
that the deadline for this task is June 9th. 


If there is anything I can do to help you, please let me know. 

□ 


FYI 


Jljanha. 



Operational Technology Division 

Telecommunications Intercept/Collection Technology Unit 
AE GIS/QTD SE AC 

(70^2_I_| 


be 

b7C 
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From: 

Sent: 

To: 

Cc: 

Subject: 



hw: urgent request- 


T(0TD)(FBI) 

t-DAG short-fused PIA tasking 


■ ttMOLAGC i n CO . bo 

NON-RECORD bvc 


FYI... thanks for handling for 3000... 


* Supervisory Special^Agent 
DCS Program Manager 



NON-RECORD 


All, 

Upon completion of your PIA and it's approval by you SC, please forward me an electronic copy no later than 10:00 AM 
Friday. 6/9/06. I will then forward OTD's submission to OGC by COB Friday. 6/9/06 in order to meet the OGC's deadline 
of "NLT" Friday. 6/9/06." Please ensure that the descriptions of your system are written in such a way as to ensure that a 
reader with no knowledge of what your unit and/or what OTD does can clearly understands, based solely on your 
description, what your system’s purpose is and/or what it does. g 

In addition, our next deadline is Wednesday, 6/21 regarding the PIA short form for your system. Upon completion of your 
PIA and it's approval by your SC, please forward me an electronic copy no later than COB Tuesday. 6/20. I will forward 
OTD's submission to OGC bv COB. Wednesday. 6/21 in order to meet OGC's deadline of "NLT Wednesday, 6/21. 

Thanks for your assistance regarding these short deadline matters. 

□ 

■ SSAl .1 

* I bbhniiai Prbcj^artli Sebtio li 
Operational Technology Division 

^< 703 ^ i ^ 




3 OTD) (FBI) 
r*06 4:52 PM 
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1 = 

From: 

Sent: 

To: 

Cc: 

Subject: 


J)TD) (FBI) 


□dTD) (FBI) 


■TliftSfIflV .lunR Qfi ?nnfi J :58 PM 

JOJD) (CON) 


Documents being sent to M 




be 

Ib7C 


SENSITIVE B U: 
NON-RECORD 


Hope all went well at your meeting and the Dr. Appt... . 

I spoke with r^iiffnrH anH advised him that we are working on this project and most of the requested documentation will 
be sent to Ms J b v COB toda y. Mr. Cliffo rd thanked us for doing a good job for such a short deadline. 

(Please put a note on the email to Ms. | i dvising that attached is what we have found to date and we are still 6 

working on this issue). 

(Please have on the CC Mr. Clifford, Mr I I Mr . I I Ms. l b nd me.. .thanks) 

Further, I advised Mr. Clifford of the other issue regarding the Privacy Impact Assessments (PIA) and DCS-3000, and that 
the deadline for this task is June 9th. 

If there is anything I can do to help you, please let me know, 

IZZI 

FYI 




□ 


Operational Technology Division 
Telecommunications Intercept/Collection Technology 
AF fiJ.tt/nTD SFA C 

(7Q3 | 1 


Unit 


SENSITIVE BUT- 
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JOTDXFBI) 



1 

TTCTU would like to purchase 30 Enterprise licenses and need to transfer $73,500 into your account. 

Should we transfer the funds into the some occount as last time? (5-2520 and the Cost Center is 20 - no 
Bl) 

Thanks, 


(O) 703-985-3488 
(F) 703-985-2765 



NON-RECORD 


Yes ) ( is the person to work the transfer through. When all is said and done, 

please lec me Itnow^and we'll allocate the licenses to you. 


— Original . 

From: koTBXCON) 

Sent Thursday. Mav il. 50Q6 8:52 AM 

To: I trroDVFBn 

Ce: I lOTD) {FBI);| baO) (FBI);! TOTD) (FBI) 

Subject: ' he: w i n 2 uua" s efvei 'image ' ' I 1 

Importance: High 


b6 

fci7C 


NON-RECORD 


We are looking to purchase 30 of the Enterprise licenses bringing our transfer to $73,500. We will 
not be able to wait until after June 15th to purchase them, unfortunately. Do I need to touch base 
with | l o get the information to tronsf er the funds? 

This is for DCS3000, which is on the major projects list. 

39 



Thanks, 



OTD/fe STS/TTCRj 
(O) 703 

(F)703. 



s the person to work the transfer through. When all is said and done, piease 


NON.RECORD 

b6 

lb7' 

We arc looking to purchase 30 of the Enterprise licenses bringing our transfer to $73,500. We will not 
be able to wait until after June 15th to purchase them, unfortunately. Do I need to touch base with 
Catherine Cruz to get the information to transfer the funds? 

This is for DCS3000, which is on the major projects list. 

Thanks, 


□ 


L 


' 6TD^g STSyiT( 
(0)70; 

(F)703| 


3y_ 


0°3 1 I 


— Original Msisa np — 

From: I |(1T0D)(FBD 

Sent: 'Thursday. May 1 1 . ?0 0fi 6:18 AM 

To: I l: OTD)(CON)j 

Subject: Rt: win zoud server Fmage I 


](OTD) (FBI) 




45 



ft><ET 


to wait until after June 15th to purchase them, unfortunately. Do I need to touch base with Catherine Cruz to 
get the information to transfer the funds? 

This is for DCS3000, which is on the major projects list. 

Thanks, 



TlWLLAJ3ll4Ee- 

NON-RECORD 


Are you looking for Windows Server standard or enterprise - and are those the only Microsoft 
products that you require? To save you some steps - Windows Server Standard is $754.14 per 
license . Enterprise is $2449.98 per license . Note that these costs decrease by around 15% or so 
after June 15 (so if you are deploying after June 15th, you would probably want to be paying in our 
next anniversary cycle of the ELA). 


Also, as a side note, is this project on the FBI’s list of major projects, which is required by the CIO 
and FBI executive management? 


— Original Mes pae — 

From; I l oTnvroN^ 

Sent Ulednesday, May in mnc dm 

To; l i fOTDI fFSn J t rODIfFBH 

Subject: RE: win 2003 server image 


•O WOLAOGir 4fiD 

NON-RECORD 


I need this info ASAP so I can get the money in motion to transfer... 

. b7C 


■OTT)/b5T5/TOT 

(O)70: 

(F)70- 


— Original Meraage^^_^___^ . 

From: I K OTO) (FK) 

Sent Wedi^v. Mav it. 2006 8:21 AM 

To: 1 Ifrrpn^^car) 

Cc: 1 rOTD)(CON) 

Subject Vw! Will 2UUJ !!8Nt!rimage 

UNCLASSlgieO 

NON-RECORD 




BET 


51 


From: 

Sent: 

To: 

Cc: 

Subject; 

Importance: 




| (OTD)(CON) 
8:52 AM 
HjIC)D)(FBI) 


|u I u) (PDi; 

win 2003 server image 


:pD)(FBI) r- 
J)TD) (FBI)L 


](OCIO) (FBI):[^ 


High 


■ W H)LACCir Ha> . 

NON-RECORD 


I I 

We ore looking to purchase 30 of the Enterprise licenses bringing our transf er to $73,500. We will not be able to 
wait until after June 15th to purchase them, unfortunately. Do I need to touch base with Catherine Cruz to get the 
information to transfer the funds? 


This is for DCS3000, which is on the mojor projects list. 
Thanks, 

I 

OTD/E 5T5/TICTU 
(O) 703f^ 

(F) 703 


Jtdkfbi) 


— Original 

From: I t rODXFBn 

Sent: TTiursday, May 11, 20 06 6: 18 AM 


UNOLAOOinCD 

NON-RECORD 


b6 

hlC 


Are you looking for Windows Server standard or enterprise - and are those the only Microsoft products 
that you require? To save you some steps - Windows Server Standard is $754.14 per license . 
Enterprise is $2449.98 per license . Note that these costs decrease by around 15% or so after June 15 
(so if you are deploying after June 15th, you would probably want to be paying in our next anniversary 
cycle of the ELA). 

Also, as a side note, is this project on the FBI's list of major projects, which is required by the CIO and 
FBI executive management? 


-- Orid |Ml Mfigaoa- 


T)TP)(C0I 
2006 3:27 


Subject: RE; win 2003 server image 


^(ITOOKFBI) 


NON-RECORD 
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From: I 

KOTD) (CON) 


Sent: , 

1 i]ftfifiav Anrii 1 1 vnriH g;42 AM 


To: 

ltnTp\ (FRI) 


Cc: 1 

KOTDHFBI) 


Subject: 

Activity Report 




bb 

NON-RECORD 


b7C 


I I - 1 have to track the dollars allocated and spent using DCS-5000 funds in an Activity Report SBIT was given 

$600,000 for DCS-3000 support. Can you provide the following information that I need for the report? 



I will also need to know the amounts invoiced each month. Call me if you have questions. 
Thanks |~~j 
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Estimated # of Items: 75 
SOFTWARE INFORMATION: 

Category : 

Manufacturer : 

CORPORAT 

Version No: 

Patch?: NO # o: 

Security Patch? : false Reported to D< 

Manufacturer : 

# of Lie. Purchased: 

VENDOR INFORMATION: 

Name : AMAX ENGINEERING C ORPORAT 

Contact Person: 

Phone # : I I 

Web Address: 

Testing 

Pimary Developer: 

Date Assigned: 

Acknowledged Date: 

Acknowledged By : 

Completed Date: 

Coit?)leted By: 

Testing and Comments: 


HARDWARE INFORMATION: 
Category : 
Manufacturer; 

Hardware Model: 

# of Hardware Purchased: 
Reported to DOJ? : false 


INSTALLATION LOCATION: 
Version/Model No. : 

Manufacturer : 

Operating System: WINDOWS 2000 


Phone : 

Ext: 

Pass/Pail : 


APPROVAL INFO. 

APPROVED BY: APPROVED DATE : 

I I 01/17/06 13:40:28 


PENDING APPROVAL: 
Approval Comments: 


Justification/Comments: _ 

01/17/06 13:40:27 by F 


(01/17/06 10:51:08 I 
Support of DCS3000 


(01/17/06 10:43:541 
Cube PC L 


75 



WINDOWS 2000 


(01/17/06 10:51:08 [ 
Support of DCS3000 


(01/17/06 10:43:54 
Cube PC I 


77 



1(OTD) (FBI) 


From: 

Sent: 

To: 

Cc: 



,'TD)(FBI) 

if IB, IdUUb 10-.46 AM 


be 

hic 


NON-RECORD 


d] 


be 

b7C 


As you know, the DCS-3000 system is used by all 56 field offices for collection of all CALEA-based pen-register/trap-trace 
intercepts for both criminal and national security investigations. At the end of CY2004, SBIT added a feature to the DCS- 
3000 system that allows us to collect specific performance metrics from each field office's DCS-3000 system. These 
metrics include the number of current intercepts, the intercept types (i.e. Title-60), and the telecom providers. We 
periodically query each DCS-3000 system for this information and populate a metrics database to help us generate 
statistics and forecasts. Here are the numbers for 2005: 


Total Intercept Targets (1/1/2005 - 9/15/2005): I I 
Estimated Intercept Targets (1/1/2005 - 12/31/2005)J 


b2 

b7E 


SBITs annual operating budget (excluding FI 
total cost per DCS-3000 based intercept (cpi)| 


ilaries) is $3,400,000. Based on our projection for CY2005, the 
following budget breakdown provides additional information: 

DCS-3000 Software Development (support and feature development for new telecom technologies); $1 ,200,000 (cpi = 
$226.42) 

Training and Carrier Liaison: $900,000 (cpi = $169.81) 

Technical Field Support; $200,000 (cpi = $37.74) 

DCSNet: $600,000 (cpi = $1 13.21) 

Capital Equipment: $500,000 (cpi = $94.34) 

This budget analysis shows the direct annual cost of the DCS-3000 system (software and ca pital hard\^^ re’> is $1 ,700,000. 
For CY2005, the cost per intercept (cost per line) for the DCS-3000 system is estimated to bel I 

The goal of SBIT is to meet and exceed the expectaiiOOSLOf^ur field office customers. To date, I think we have 
accomplished this goal with remarkable efficiency r h er line is two orders of magnitude less than any commercial 
system). The members of SBIT are proud of our accomplishments and reputation, and we hope to continue to do 
good work on behalf of TICTU. 

□ 



F2278975 


3LKFZ71 


F2278966 

F2279055 

F2278965 

F2278964 

P2278962 


6LKFZ71 

CBGHZ71 

7LKFZ71 

BLKFZ71 

5LKFZ71 


4. State whether computer system(s) is a server, desktop or notebook 
All of these systems are servers 

5. State the enclave, Program and/or network that the system is connected to [such as FBINET, SBUNET 
(formerly Internet Cafe), SCION, Standalone, etc.), along with the system classification 

DCS-3000 Unclassified 

6. Provide a justification that identifies the business requirements for the software 

DCS-3000 is a pen/trap/trace collection system for criminal and FISA CALEA intercepts. These systems are 
needed to upgrade or expand various systems in the field. 

7. Provide the name of the approving official, title (at FBIHQ, must be Unit Chief or higher; for Field 
Offices, must b e the SITS or Lead ITS), and the Unit/Section/Division. 

I \ ^C, TICTU/ESTS/OTD 

Please let me know if you need any additional info. 



— Otjoinal Mssfage — , 

From i P IPP)(C0N) 

Se nt; Tuesday, August 1 *0005 11:53 AM 
To i I fOTDj (FBI) 

Subject: RE: Microsoft Licenses 

lb 6 
b7C 


■ i nfmmfi- 

IL.LP 

NON-RECORD 




I askec 



f gain. In the meantime, I will talk with the CM iibrarian to see whether we have the licenses. 


Lontiguration Management Specialist 

CM/PPMU 

Room 10373 


Ext I I 


lb 6 
b7C 
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Subject: FW: Microsoft Licenses 


NON-RECORD 


I 

TICTU has purchased 20 Dell servers from the approved taseline hardw are list. Now we need the operating system 
licenses for these servers. I have attached the email from ! I where he explains that we need to go to the 

TCCB. These servers will part of the standalone DCS-3000 collection system which is not connected to FBINET. 

Please let me know what our next step should be. 


your helpl 


From| 

1 (ITSD)(FBI) 

seritiltJflodai 

. August ]s. 2005 6:29 AM 

To:T 

l(OTD) (FBI) 

Subject: RE: Microsoft Licenses 


cpinm 

NON-RECORD 


IZZI 

I'll try to simplify your life here... Contact P ^ t 202-324 1* I advise her that you are 

looking to build and implement 20 Dell servers to the field. She should oe able to submit the request 
for you. Be sure to include all aspects of what you arr looking to do (all of the specifics of what the 
servers are for, what software you plan to install on them, etc.). She should be able to but it on the 
TCCB’s agenda. After approval of your request, I can allocate the Windows Server OS licenses that you 
require. 


be 

b7C 


For the Windows OS licenses. I'll need the following information (the approval of your change request 
and the assigning of the licenses are two separate items): 

In addition to stating the product(s)/vereion(s) that you need, please provide: 

1. Names of person(s) that will utilitize these licenses (if known - if systems will be used randomly by 
various personnel, then just state as such). 

2. State whether licenses are for FBI Employee or Contractor use (breakdown the quantities if 
necessary). 

3. List the Property Number of each computer system that license will be used on. 

4. State whether computer system(s) is a server, desktop or notebook 
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"bTDHFBD^ 


From: 

Sent: 


Subject: 


1 I ^OTD^ (FBI) 

Th.Tsriav .I.iivn? 9 f^fi 5:24 PM 
I T( 0 TD) (FBI) 

' Hbi ' TOi grr p ' 


UNCLA 33 iriCD 

non-recorF' 


I 1 

This is fine. Just a couple of extra items. Let's start this wayl 

There is a ContracLBeJUfiaadElaarcl scheduled for July 14. 2005 at 2:30 pm. Unit Chie l h dC ~~l will 

represent TICTU. I l Enaineerina Contracts Unit vwll be seeking contract approval. The contract is with Booz 

Ailen Hamilton for the amount of $2,100,000. 


The DCS-3000 is_ 


Any questions regarding the Contract Review Board please contact 


uQ' ext. D rmeat *»<dl 


See me before you send this up. 

□ 

Original Message 

From i k OTD) (FBI) 

Se nt; Tfiursdav. July oTTalQS 1:43 PM 
To; l I f OTP) (FBI) 

Subject: Write up 


NON^^ECoi^ 

' be 

b7C 


The following is the write up I am going to send to AD Haynes and 
Section Chief Clifford, per you approval. 


Thanks 



Information regarding the Booz Allen and Hamilton (BAH) proposed 


Contract, due to go to the Contract Review Board on July 14, 2005. 


History: 


• DCS-3000 software suite, which has in excess of 490,000 lines of 
computer code, maintained by BAH. 

• BAH has been aictive in the development of this CALEA software 
interface for more than seven years. 


Asking for; 


Logistical support in training and liaison. The need for personnel to 
tactically implement court -authorized ELSUR and react in exigent 
circumstances to threats of life is a necessity that requires a significant 
amount of training and liaison. This requires industry leaders with unique 
'abilities and backgrovinds . 

Support with continue software development pertaining to the FBI's 
ELSUR capabilities . The continuing emergence of new telecommunications 
technologies requires a unique ability to design and implement solutions at 
accelerated rates. The lack of a c[uick reaction capability to adapt ELSUR 
techniques within the FBI may result in significant vulnerability and 
exploitation opportimities to enemies of the United States. 


Budget Matters (FYI) : 


• Requisition sijbmitted for $2,100,000.00. Due to lack of time on the 
existing contract, an interim purchase order (PO) was put into place. 
The money used for the interim was. taken from the original 
requisition. 


TICTU 
(7( 


b6 

fo7C 
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From: 

Sent: 

To: 

Cc: 

Subject: 


Retention Badge to[ 


^ITD) (CON) 
7011510:27 AM 
iliq (FBI) 
iinuFRn 


NON-RECORD 


C 


~l here is a request for a 
ltto | \ anil J 


retention badge foiQ 


lbt5 

b7C 


3nd if it meets your approval, you can forward 


It is requested that| | Booz Allen contractor, receive a retention badgej” 

Top Secret clearance, is assigned to an on-going DCS-3000 project for TICTU/SBIk 

If you have any questions, please contact Unit Chie j | at 70 ^ 

Thank you. 


1 who currently has a 





□ 

The answer to the questiaoJIare we capturing the IMEI ...” is yes ... buL^fiecAULd^ussion a few weeks 
ago, we modified th j p ediat ipn svstpm at Quantico to oenerat d I messages (the systems ^2 

in the FB I field officA orin; mnisum d tn essaoes so we have to translate from the proprietary b7 e 

I f ormat to the standa rd formats usi ng both the MSISDN (phone number) and IMEI as the "caseid” (the 
'eagSia fe a tag used in eac H t iessaqe to identify the target). We made this modification assuming 

the IMEIs would be known by you and that you o)uld provision your equipment to collect against the known 
IMEI and/or MSISDN. The system at Quantico buffers the data based on caseid so any calls from unknown 
IMEIs are automatically buffered here until requested by th e field. So when I rece ived your email I checked j ^ 
the buffer, and there is buffered data for one lin knnwn iMEI j r ou can retrieve this data by f 

entering this IMEI into the DCS-3000 1 ^ I can assist with this task). ^ 

To better accommodate your investigation we will modify (hopefully by COB to day) the DCS-3 Q00 system 
software for your office to capture and display the IMEI and IMSI in the relevan t j iessages 

(Origination and Termination Attempts). Unfortunately, TA does not suppot da j^fig'Tia aB'for IMEI and IMSI. 

So, future uploads/downloads from TA will not give you the information. You or ! I vill have use the DCS- 
3000 to mine the IMEI data - 1 can give you a simple text-based script to mine and report this information. 

The good news is we have the data for the unknown IMEI ready for you to collect and we will give you a better 
method to determine unknown IMEIs going fonArard. 

□ 



SENSITIVE BUT U N OLA38IP ie D 
RECORD 315J-IVIM-10S011 



SENSITIVE BUT O WU-AJS i r i LU 

OTHER OUT OF SCOPE 

SENSITIVE BUT UNOLAJJI FI LTr 






From: 

r— — 

bTD) (FBI) 




Sent: 

weanesdav. 

March aa: 2006 11:27 AM 




To: 


OTDj(FBI)i 

_ l« 

DTD)(FBI)J 

J 




□ (UID) (hbi: 

>=L_ 

IfOTD) 


Subject: 


FW: Hriviiegea user KOie-uased Training 


NON-RECORD 


b6 

b7c 


I believe below would be your unit's call. 
Please advise. 

Thanks. 


Program Manager ■ Enterprise Operations Services 

Elsur Technology Management Unit (ETMU) 

Electronic Surveillance Technology Section (iSTS) 
Operational Technology Division (OTD) 

ERF. Ouantico, VA 

Tel: I 

Ftuc 


---Original Mesagg::::: 

From! I K OTDI (CON) 


Sent: 

Tuesday, March 07, 2006 5:20 PM 


To: 


5TD) (FBI) 


Cc; 

1 

(ITD) (CON) 

hZ 

Suldect: 

RE: Privileged User 

Ole-Based Training 

be 


NON-RECORD 


Even with the extension of time to complete the training associated with being a privelaged user, we should probably 
identify which systems need to have the privelaged user Ruels of Behavior (ROB) created for. As I see it there are 
primarily three systems that are supported by the DCSP that each should have a ROB form. They are th e! i 

System (DCS500Q) the Voice Box System (DCS6000) and the DCS3000. My understanding is that each of these will be 
accredited at an enterprise level such that the system in Albany and the system in Portland both fail under a single ROB. 
But the Biree separate type of system each require their own ROB. So each system administrator will fill out three ROBs. 


The form on the Security page I lonly has a 

generic Rules of Behavior fomrf Wai I’^djUirfiS SyStSW name Snify. I 'O aVOIfl MUTUSldfl, I Mdlfl rSCfimfflSnfl Wat TICTU 
identify how they want the system names to appear on the ROB. I believe that since each system is acredited seperatly 
that a unified "ELSUR Systems" ROB would not be in order. 



ELSUR Technology Management Unit 
Electronic Surveillance Technology Section, OTD 


e^BEt 


SI 




(Desk) 

(Fax) 

(Cell) 



fo6 

b7C 


](OTD)(FBI) 


From: 

Sent: 

To: 


Hn)(fbi) 



J(HNI£B.IJ 


I KOTD^ (FBnr 


lhm.(FBi)r 


(FBI)C 

(OTD) (FBI)t: 


Power Outage Friday 8/18/2006 


Jexucon)| _ 

IZJLA) (COnf 


|OTO|(CON)l .. „ . 


IfOTm /FBIU 


SENSITIVE BUT H WeLAOOiriDD 
NON-RECORD 


To All, 

I have been notified b l h hat GSA will be shutting down all electrical service to the Federal Building on 8/18/2006 

from 6:00 p.m. to 2:30 am. 

Thorofr.ro tn hrinn Hr.»/n all nf rho orimpiitorc jn the CMP gracefully, W6 (tech Quys) wil! be shutting down the ! ~1 
Voice Box I I DCS 3000 and any other system that I forgot about on Friday 8/18/2006 at 4:30 pm. 

You will need to turn off your computers and shut them down (turn off the electrical system) at that time. This includes all 
of the printers and anything el se connected to a n electrical plug to include the UPS systems. If you don/t know how to doj^? 
it, please let one of us (myself, ^ 1 know prior to Friday. 

All of our collections will cease as of that time until we get back in on Saturday 8/19/06 to 

]^mputer & printer prior to COB on Friday 






] Please turn off youf^ 
^ FYlforCSOC. 

□ 


turn on all of the systems. |j. 7 g 
8/18/06. 


SENSITIVE BUT UMGLA66 i riED 




JOTDHFBI) 


From: 

Sent; 

To: 

Subject; 


](HN)(FBl) 


-Friday. June2£iQflgJ^,PM 

I l(OTD) (FBI) 

"T^b; HyA-tJuam ' 


SENSITIVE BUT U N OLAOO i nC D 
NON-RECORD 


OK Will be in contact with Guam Telephone. 


O) 

C) 


SAT 


Tech Advisor 


b6 

b7C 


— Original 

From: 

Sent: 

To: 

Cc: 

Subject: 


lS liUUb a:50 AM 
lrHN>j-FBn 

J(OTD) (FBI)I 


SENSITIVE BUT 
NON-RECORD 


](OTD) (FBI) 


We're sending you a new rack-mount computer for the GR30 solution. No special needs for the data circuit (it's a 
1200 baud data connection) other than analog POTS line. We recommend one CDC POTS tine per 5 targets. You 
can push this up to 10 targets per CDC line if necessary, but you may get unacceptable latency on the CDC delivery 
■ above 5. One will need 1 POTS line per target for the CCC delivery. Of course, this planned solution will only work if 
^^^hets the GR30 solution implemented on their switches, which is still in question. 

D 


b2 

h'^E 


IQmit: Thiirsdav. liinp 75 7nnAin'4APM 





To: 1 lOTO) fFBUJI 

1 


_|pTP)j£BD 

IHM) (FBIl 

HhN^ rFBIV 

(hn)(fbi):| 

imm\ 

hN) (FBlj 

— *™^(HN)(FBI)|_ 



fe6 

b7C 


SENSITIVE BUT- 
NON-RECORD 


CD 

Looking at getting the GR-30 solution for the pen's 
we need for our DCS 3000? 


frorr ^ ^ nd 


ring down 


circuit for the audio. What do 


We virant to do a test with the | j 'elco. How do we go about doing it? Does the ring down circuit for the date 
need to be groomed to a speancspScification? 



n 

Looking at getting the GR-30 solution for the pen's from i l and then a ring down circuit for the audio. What do we 
need for our DCS 3000? 

We want to do a test with the l i Telco. How do we go about doing it? Does the ring down circuit for the data need to 
be groomed to a specific specification? 


SA| 1 

Te dil rtUVItiU I ' 

FBI - Honolulu 




(HN)(FB1) 

)ctober06.2004 3:24PM 

3 ITD)(FB1)j 

^hnufbH 


ntercepts on voice Box II 


SENSITIVE BUTt 
NON-RECORD 


Aloha!! Am getting s!ammecl on the l C overages on Voice Box (VB). Problem is that th d i coveraaes goes 
down in the middle of the wnre for some unknown reason. The VB cannot handle the intercept and the interconnect 
coverage ceas es on certain iines. v yhat we have done is to switch boxes out, going from the Adtran-BRI card to the 
I I box and restarting th 4 I server. When we do this, it seems to be stable for a period of time the n the 

interconnect coverages goes down. This is a random situation, but occurs during a peak time during the] I 


The drug squad is contemDl ^t i n<^ I of which a number wiil probably be l 

phones. We currently have | | ip and am having problems randomly on the interconnect (not an every day 

situation, but enough probiems to cause a headache). 


Need your help, to explaiaJaii:^ drug squad/supervisor & ASAC what the problems are on thel 
field is either restart the l l erver or switch the receiver from the BRI ca rd to thel 
/ho d l and I) cannot provide an adequate explanation as to why thes^ |coverages ft 


, ^ 11 we do in the 

aRrtack and forth. We 
luring the middie of the 


FYl, I received an e-mail from 
situation which follows: 


in 8/9/04 which answered our problem during a period prior to the ongoing 


I understand your office recently experien 
informed me late Wednesday evening tha 
problem may be due t o a known bug in th 






wflth one of vou i T itle Ills, 
upport group suggested t he lack 
Over the last few months 


support technicians have experienced a specmc problem during this 

order is still active. T his problem is attributed to 
working with l 1 o resolve this problem. 

sympram mat your o nice receniiv ^ nerienced. Unfortunately, the support person on call late 
Wednesday evening did not ftjily understand the| |l got my information from their senior technician. 


In an attempt to resolve the problem, the on call technician removed the intercept from thd 
it at sometime around 10 pm EDT. Your DCS-3000 indicates audio intercept was re ^tabl 
evening. So, it app ears the act of re- provisionlna the intercept resolved the problem i 
convinced it was ail land I am not sure either. 


l and re-entered 

id at 18:30 Hawaii time Oiat 
senior technician is not 


Pen-register problems are much easier to troubleshoot than audio problems because the pen-register data is 
delivara d using TCP/IP, for which we have many troubleshooting tools that we can remotely execute from Quantico and 
l-. an remotely execute from their offices in Virginia. 


The CALEA solution that l l uses. like all other wireless service providers, intercepts a target's audio in the switch and 
sets up a three-way conference bridge between the target, associate, and the law enforcement collection equipment. 
There are multiple potential points of failure in this delivery scheme: 1) the law enforcement collection equipment 


JkSet ® 

(telephone line, telephone interface equipmem, or collection system) may be unavailable to receive calls from the switch, 

2) tile switch may not have a conference bridge resource available to setup the call to law enforcement (the conference 
bridge resources are shared among all law enforcement agencies and among all normal subscribers on the system), 3) 
the switch may not have an available external line to dial out to the law enforcement agency (the external trunks/lines used 
to delivery normal calls from the switch to the PSTN are the same trunks used to deliver intercept audio to law 
enforcement), and 4) the call intercept software on the switch may fail. This audio delivery method is used by all wireless 
providera and most have experienced some form of intercept audio failure. The alternative to the dial out solution is for the 
law enforcement agency to establish a point-to-point T1 connection to the switch. This solution has the highest 
delivery reliability because it uses a dedicated connection between the switch and law enforcement collection equipment 
Howeve r, it is too expensive for most cases and is impractical to implement with a carrier that has many switches (e.g. 

I l as approximately 100 switches nationwide). 

Troubleshooting audio intercept problems associated with wireless providers can sometimes be difficult The reason is 
there are few troubleshooting tools available, and neither law enforcement nor the service provider has full access to botii 
ends of the delivery system for troubleshooting. Both the law enforcement agency and service provider must attempt to 
troubleshoot the problem in concert. This often takes time to accomplish. 

For your most recent case, it is impossible to identify the exact point of failure in the delivery system since we did not 
have adequate time to test each point in the system before it started working again. We have a test phone and collection 
system similar to your office's sy stem at E RF. We tested several scenarios yesterday and were unable to reproduce your 
problem. I also anal yzed all vt^ r i l en-reoister information collected on the DCS-3 0Q0 on 8/4/2004. This data h2 
suggest that your othe l r itle-lll was working fine during the period of failure for th d I number. This almost b 6 

certainly eliminates the possibility that the problem was due to a conference bridge or external line resource limitation. b7c 

I t old me that you tested your collection syste m by calling into the ISDN delivery line and everything check out. So, b7 e 
, thpnnhr nlaiisi|r>le explanations for the failure are: 1)| Isystem failed for the specific target, or 2) the 

I f ailed. That's my best guess. 

If you have any questions, please call me at 703| | 

a 

I was wondering if this situation still applies? Can you provide me with some answers? 


Thanks. 


SENSITIVE E 


sbLi 


:ET 
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(OTP) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 


HdTDHFBI) 


iber 22. 2004 2:35 PM 


TxtMsg 


J(ITD)(FBI) 


NON-RECORD 


Hi l I 

Thfl RW icn't capable of handling TXT messaging to date, however, the OCS-3000 can support this. I spoke to I I 
I b bout your need. If you don't hear from him soon, feel free to give him a call. Please let me know if you have any 

further questions. Thanks. 


Hagg^olidays, 


I I (OTDj (FBI) 

From: I l(ITD) (FBI) 

Sent: Monday, November O ff. 2004 1 :45 PM 

To: L-. .... . J'TD) (Cp|)j,) 

I f (ITD)(FBI) 

Subject: Gratitude for Special Support 


SENSITIVE BUT UMfrUASglFIED 
NON-RECORD 


Hi l I 


be 

Ib7 


I just wanted to extend my gratitude to | [ for the operational support he is providing, Spe cificallvC!!! I 

is instrumental in helping with the developmsnt ana'deployment of the DCS-300 a fe vstem. SLC was the 

first official test site approved from the security office which assisted us in order to determine the robustness of our 
system. It was during »iis test phase that improvements were developed by Raytheon and incorporated into our latest TIU 
Software base-line. The new software enables the CCC and COC data to be correlated using a time-based aia nrithm. 

A vast improvement from hard copies and manual correlation. Although the new software hasn't been validated P | 
continues to provide us with invaluable information. His efforts continue to help us gain great strides as we begin tb 
establish new operations throughout the field. His expertise and knowledge has assisted us in completing our initial goals. 
We are fortunate to have him on our side. More than thanks are truly in order. 


^ Regards^ 


SENSITIVE BUT UNGLAJJI P IBP - 


From: I l lTD) (FBI) 


Sent: 

Wednesday. OctobeM3. 2004 3:27 PM 


To: 

1 , n-D^ fFRn 


Cc: 

1 riTDl fCON« 


Subject: 

DCS-3000 upgrades fo| 

IflTD^ fF^ 


UlilCI »0QIPIEtr 
NON-RECORD 


b2 

bb 

b7C 

b?E 


“lanH I spoke briefly about the best approach to upgrade DCS-3000 apllications on thd hachines 

during their life cycle. Please ponder a bit on this and let me know what you decide. * . , , . . n - . J 


t guess I would prefer not being responsible for upgrading them from ERF via 


& 


uNGLABa iPteir 


From: 


To: 

Cc: 

Subject: 


(S) 


SECRET 


RECOR 


~|(OTD) (FBI) 


30TD) (FBI) 
rZ0Q6 1:00PM 


RE; DCSSOOdliifferenftir 




J(HN) (FBI) 


Afferent time zones/dates/Hi LO Server 


bl 

be 

b7C 


Guys, 

I ^ rote: 

"Honolulu needs to configure the intercepts on thel ja nd on the low side machine. If the data arrives at theQt or 
near the same time as the audio is received th d j Bill correlate the two data streams, regardless of the time stamp in 
the data. The linguist in Po rtland s hould see a HN timestamp in the session window - very close examination in the 
telephony log will reveal thel Itimestamp, But, I don't think the linguist are looking at the telephony log timestamps - 
shouldn't be a problem." * * 

FYI: 

There are many issues with the OWP and inconveniences are being experienced by Case Agents, Linguists, ERF, etc. We 
can get your OWP set up, but you'll have to deal wth the problems currently facing the system. It's your call to whether to 
implement as is, or wait? 
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Thnx, 

-ca 


— Original Message — 





Got a situation hopefuiiy you can heip us. 

ftiU b ae a FISA ir i I 

I | The CCC and CDC are brought to HN and then WAN to HQ where the LS is located. We are using the GR30 
solution to bring the CDC to the DCS3000 and audio is coming through separate B1 lines to the DCS5000. The CCC 
is currently being WAN out, and Oie CDC is being put into Telephone Applications where the LS will match them. 

The CCC being received on the 5000 is showing HN time. We need the 5000 to match the CCC and CDC if it can be 
done. Our understanding is the 5000 will not match the CCC and the CDC as the times/date are vastly different. Or, 
will the 5000 match the CDC rrr ar^nr/unn tn tho tiiwa jn HN, notwithstanding the actual date/time 

shown in the CDC (which will be I I 





I understand we need to go through the HI/LO server on a one-way push for the COC to the 5000. We never used the 
HI LO for any previous calls. Any info on how we should do this is appreciated. 


h2 


This FISA will be long term. If the CCC and CDC are not matched In the 5000 can there be software changes so we 
have a solution? 



I bell 
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I forwarded all the RW sessions I had for 8/8-9/06 (up through about 1530 hrs) and attached is a copy of the DCS3000 
report for this same period. You will see that DCS shows Associated DNs in some sessions and RW does not. You will 
see that DCS3000 shows more calls that RW reports. Thanks for all you've already done. 



8583826344_All.rpt 
■txt (24 KB)... 



PBW6P.EgQM^: Mu ^ 

J4ht.LAJAIIT^ri0T1 

SECRET 


[ 


1(OTD)(FBI) 


From; 

Sent: 

To: 

Cc: 

Subject: 


L.. „ l (OTD)(FBn:L 

FW; Contingency plan information 


]OTD) (FBI) 
ll2PM _ 
~(OT D) (FBh:r 

(FBI):IZ__ 


, lOTDl (FBI) 
J(OTD)(CON) 


NON-RECORD 


] 


Can your ISSO provide the information requested for the OCS-30007 
Thnx, 


— -Original Mesrage;;;^ 


Monday, tulv 17. 2006 12:16 PM 

' IgroxcoiM) 

□(OTD) (C0N);Q 


RE: Contingency plan information 


3otd) (FBI);Q 


b6 

b7C 


NON-RECORD 



I need contingency plan results for the following systems; 
Data Collection System 3000 





Data Collection System 5000 


J 


^,Than]c_^u, 


— Original 

tim: L 


□COTD) (FBI) 


Monday. July 17. 200T12:12 PM 
I Z-J (SecD) (FBI^ 

J(OTD)(a3N| 


(OTD) (FBI) 

Subject: RE; Gontingency plan infbrmaeon 


be 

b/c 


ToTD)(CON);[ 


□ (OTD) (FBI)|^ 


NON-RECORD 


I 1 

Per our phonecon - 1 |is the ISSO for the systems in question. I'm sure he will 

be able to provide anytning you neea. i hough I believe that he may be out of the office at least 
part of this week. 


supervisory engineering Technician 
ELSUR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Operational Technology Division (OTD) 

ERF, Qu antico. VA 
Tel: (703| I 

Cell:(202^ 

Fax: (703^ 


— ongnal Message--- , 

From: | ISecD) (FBI) 

Sent: hilv U Jllllh rv?K am 

To: I I rOTDl (FBI) 

Subject: Contingency plan information 


NON-RECORD 


I I 

I need contingency plan results for the following systems: 

Data Collection System 3000. 

Data Collection System 5000 


Yban^^Si 




SENSITIVE BUT UMCLAOOIH E O 
NON-RECORD 


Try setting the following features from "False" to True" as listed below. Pick a handful of very busy targets to test. 

1) Choose Target Line: 

la) SupressSMS = True 

lb) SupressLocation = True 

Let us know if this makes a difference. 

Thnx, 

-ca 



Subject: DCS-3000 to RW testing 

non-recorF 


Guys, 

We have being looking at the cell phones from the OCS-3000 that we put into RW for CDC. It seems to be 
working well with two minor issues. One is that it changes the description in the playback field from V to D every time 
because of the CDC message. Not a big deal. The second issue is every time we get a CDC message there is a 0 
second session that follows the call. It is some where between 30 seconds to 2 minutes after the call. We looked at 
some of them and it looks like it is some kind of message release signal being sent down the line. It is happening on 
all the cell phones, not just specific companies. Any ideas for fixes? Thanks. 





(OTD) (CON); 


From: 

Sent: 

To: 

Cc: 


Subject 


b7C 

he 

hlC 


NON-RECORD 

□ 



](UIU)(l-bl) 
Tsit 


3)TD)(FBI) 
!D0^4:54 PM 


(OTD) (FBI);! 


I l and I are planning another trip to your FO, Weds. 5/17/06 to troubleshoot the DCS-3000/5000L 

Please let us know if that works with you and whom are POC will be. 



be 

b7C 


I l(OTD)(FBI) 


From; 

Sent; 

To: 

1 KOTDI IFBIl 

Monday. February 27. 2006 8:28 AM 
TfNYI (FBh , 


Cc; 

{ l(NY)(FBI);l 

3nY)(FBI);[[ 

Subject: 

roTO IPBh:l kj 1 unhoi) 

FW: RW upgrade and CALEA 


Importance: 

High 



] 


SENSITIVE BUT WWLAOC i nCD 
NON-RECORD 

□ 

I | and I are planning to perform the install this Wed, 01Mar06. Does this work with you? 

Also; 

1) Is the DSL circuit installed and ready to go? 

2) To support the new equipt, what type of rack do you have - square holes or round self-tapped 
holes? 

3) RW NY#1 or #2 - what type of kvm switch, cable type -Cats or PS2A/ideo, and is there an 
available port? 

Talk to you soon, 


16 

SFtfePT ^ t 


